Splunk Search

Combining values across multiple fields in an event

jstockamp
Communicator

I've got a bunch of similar fields in my events. I've got fields named term0-9 and I'd like to create a chart that shows the top terms across all those fields.

For example, if I have an event where term0="First+Term" and term1="Second+Term"

Event #    term0    term1     term2
-------    -----    -----     -----
1          Bob      Mary      John
2          Mary     Jake      Tim
3          Bill     Tom       Sally
4          Sam      Sally     Mary

I'd like to output a chart that shows:

Term           Searches
----           --------
Mary           3
Sally          2
Bob            1
John           1
Jake           1
Tim            1
Bill           1
Tom            1
etc .......

Is this possible. If I just combine the fields into one and group based on that, then the order of the search term becomes significant and I don't want it to be.

Anyone have any ideas?

mkashif
Explorer

Hello,

you can achieve your objective using top command and count by command

0 Karma

jstockamp
Communicator

Care to give a little more details on your suggestion? How do I do this across multiple fields?

I can do

top 20 term0

but I don't know how to have it evaluate multiple fields. Thoughts?

Get Updates on the Splunk Community!

The OpenTelemetry Certified Associate (OTCA) Exam

What’s this OTCA exam? The Linux Foundation offers the OpenTelemetry Certified Associate (OTCA) credential to ...

From Manual to Agentic: Level Up Your SOC at Cisco Live

Welcome to the Era of the Agentic SOC   Are you tired of being a manual alert responder? The security ...

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 4)

Welcome back to Splunk Classroom Chronicles, our ongoing series where we shine a light on what really happens ...