Splunk Enterprise

count two fields by their (not necessarily common) values

petreb
Path Finder

Hello,

I have the following table

itemattributefirst_seenlast_seen
item1attr101.01.197001.01.2000
item2attr201.01.197001.01.2020
item3attr301.01.202101.01.2021

 

and I would like to count the last two fields based on their value (as in the table below). 

datecount(first_seen)count(last_seen)
01.01.197020
01.01.200001
01.01.202001
01.01.202111

 

I have tried to achieve this by using two searches and appending them, but I'm stuck at grouping them by date, which is a value of the 2 fields which can be common or not.

 

 

 

..........
| stats count by last_seen
| append [
..........
| stats count by first_seen]

 

 

gives me the table below, which is a step forward, but far from what I need

last_seencountfirst_seen
01.01.19700 
01.01.20001 
01.01.20201 
01.01.20211 
 201.01.1970
 001.01.2000
 001.01.2020
 101.01.2021

 

can anyone give me a hint?

cheers 

Labels (2)
Tags (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @petreb,

Please try below;

..........
| stats count as count_last by last_seen
| append [
..........
| stats count as count_first by first_seen]
| rename last_seen as date, first_seen as date
| stats list(count_first) as count(last_seen) list(count_last) as count(first_seen) by date
If this reply helps you an upvote and "Accept as Solution" is appreciated.

petreb
Path Finder

isn't what I needed (the last column is still empty), but gave me other ideas which kind of solved my problem 🙂

0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...