Splunk Search

Combining values across multiple fields in an event

jstockamp
Communicator

I've got a bunch of similar fields in my events. I've got fields named term0-9 and I'd like to create a chart that shows the top terms across all those fields.

For example, if I have an event where term0="First+Term" and term1="Second+Term"

Event #    term0    term1     term2
-------    -----    -----     -----
1          Bob      Mary      John
2          Mary     Jake      Tim
3          Bill     Tom       Sally
4          Sam      Sally     Mary

I'd like to output a chart that shows:

Term           Searches
----           --------
Mary           3
Sally          2
Bob            1
John           1
Jake           1
Tim            1
Bill           1
Tom            1
etc .......

Is this possible. If I just combine the fields into one and group based on that, then the order of the search term becomes significant and I don't want it to be.

Anyone have any ideas?

mkashif
Explorer

Hello,

you can achieve your objective using top command and count by command

0 Karma

jstockamp
Communicator

Care to give a little more details on your suggestion? How do I do this across multiple fields?

I can do

top 20 term0

but I don't know how to have it evaluate multiple fields. Thoughts?

Get Updates on the Splunk Community!

Insights from .conf 2025, Smart Edge Processor Scaling, and a New Splunk Lantern ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Machine Learning - Assisted Adaptive Thresholding

Let’s talk thresholding. Have you set up static thresholds? Tired of static thresholds triggering false ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...