Splunk Search

Count by two different fields in one result

humi
Explorer

Hello all, i'm sure tje answer exists somewhere but i can't find it...
As you can see, i start with this powerfull tool, and i need help.
I have logs with FIELD1 and FIELD2 which concern the samething (IP ADDRESS).
I need to chart a count of each line of log where FIELD1="A" OR FIELD2="B" in a bargraph by FIELD1 and FIELD2.

So to see count of log by IP Address (which are in two differents fields.
I hope i'm understandable...

I stoped here (that display only count for the field i count by)...

index="XXX" FIELD1="A" OR FIELD2="B" | chart count(eval(FIELD1="A")) AS "AnswerA", count(eval(FIELD2="B")) as "AnswerB" by ???

 

Many thanks!

Labels (1)
Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

if you have some events only with field1 and some events only with field2, you could aggregate the values from field1 and field2 in the same field and use it:

index="XXX" (FIELD1=* OR FIELD2=*) 
| eval IP=coalesce(FIELD1, FIELD2)
| chart count BY IP

Ciao.

Giuseppe

View solution in original post

humi
Explorer

Thanks Giuseppe ! 

It's so simple when the solution is given...

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @humi,

if you have some events only with field1 and some events only with field2, you could aggregate the values from field1 and field2 in the same field and use it:

index="XXX" (FIELD1=* OR FIELD2=*) 
| eval IP=coalesce(FIELD1, FIELD2)
| chart count BY IP

Ciao.

Giuseppe

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...