Splunk Search

Combining values across multiple fields in an event

jstockamp
Communicator

I've got a bunch of similar fields in my events. I've got fields named term0-9 and I'd like to create a chart that shows the top terms across all those fields.

For example, if I have an event where term0="First+Term" and term1="Second+Term"

Event #    term0    term1     term2
-------    -----    -----     -----
1          Bob      Mary      John
2          Mary     Jake      Tim
3          Bill     Tom       Sally
4          Sam      Sally     Mary

I'd like to output a chart that shows:

Term           Searches
----           --------
Mary           3
Sally          2
Bob            1
John           1
Jake           1
Tim            1
Bill           1
Tom            1
etc .......

Is this possible. If I just combine the fields into one and group based on that, then the order of the search term becomes significant and I don't want it to be.

Anyone have any ideas?

mkashif
Explorer

Hello,

you can achieve your objective using top command and count by command

0 Karma

jstockamp
Communicator

Care to give a little more details on your suggestion? How do I do this across multiple fields?

I can do

top 20 term0

but I don't know how to have it evaluate multiple fields. Thoughts?

Get Updates on the Splunk Community!

Finding Based Detections General Availability

Overview  We’ve come a long way, folks, but here in Enterprise Security 8.4 I’m happy to announce Finding ...

Get Your Hands Dirty (and Your Shoes Comfy): The Splunk Experience

Hands-On Learning and Technical Seminars  Sometimes, you just need to see the code. For those looking for a ...

What’s New in Splunk Observability Cloud: January Feature Highlights & Deep Dives

Splunk Observability Cloud continues to evolve, empowering engineering and operations teams with advanced ...