Splunk Search

Count by two different fields in one result

humi
Explorer

Hello all, i'm sure tje answer exists somewhere but i can't find it...
As you can see, i start with this powerfull tool, and i need help.
I have logs with FIELD1 and FIELD2 which concern the samething (IP ADDRESS).
I need to chart a count of each line of log where FIELD1="A" OR FIELD2="B" in a bargraph by FIELD1 and FIELD2.

So to see count of log by IP Address (which are in two differents fields.
I hope i'm understandable...

I stoped here (that display only count for the field i count by)...

index="XXX" FIELD1="A" OR FIELD2="B" | chart count(eval(FIELD1="A")) AS "AnswerA", count(eval(FIELD2="B")) as "AnswerB" by ???

 

Many thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

if you have some events only with field1 and some events only with field2, you could aggregate the values from field1 and field2 in the same field and use it:

index="XXX" (FIELD1=* OR FIELD2=*) 
| eval IP=coalesce(FIELD1, FIELD2)
| chart count BY IP

Ciao.

Giuseppe

View solution in original post

humi
Explorer

Thanks Giuseppe ! 

It's so simple when the solution is given...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

if you have some events only with field1 and some events only with field2, you could aggregate the values from field1 and field2 in the same field and use it:

index="XXX" (FIELD1=* OR FIELD2=*) 
| eval IP=coalesce(FIELD1, FIELD2)
| chart count BY IP

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...