Splunk Search

Combining values across multiple fields in an event

Communicator

I've got a bunch of similar fields in my events. I've got fields named term0-9 and I'd like to create a chart that shows the top terms across all those fields.

For example, if I have an event where term0="First+Term" and term1="Second+Term"

Event #    term0    term1     term2
-------    -----    -----     -----
1          Bob      Mary      John
2          Mary     Jake      Tim
3          Bill     Tom       Sally
4          Sam      Sally     Mary

I'd like to output a chart that shows:

Term           Searches
----           --------
Mary           3
Sally          2
Bob            1
John           1
Jake           1
Tim            1
Bill           1
Tom            1
etc .......

Is this possible. If I just combine the fields into one and group based on that, then the order of the search term becomes significant and I don't want it to be.

Anyone have any ideas?

Explorer

Hello,

you can achieve your objective using top command and count by command

0 Karma

Communicator

Care to give a little more details on your suggestion? How do I do this across multiple fields?

I can do

top 20 term0

but I don't know how to have it evaluate multiple fields. Thoughts?

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!