Splunk Search

Count number of field value per source and show as table

christopheryu
Communicator

I have a field named "router" that has multiple values and have three sources. I would like to count the router values for each source and put them in a table.

So the three "source" values are syslogs, enviro and triggers and "router" have multiple values (e.g, ABCD, EFGH, KLMN). I would like to put in a table the total count of distinct "router" value for each source as shown below:

router syslog enviro triggers
ABCD 3 4 8
EFGH 2 5 9
KLMN 3 7 8

thank you in advance!

0 Karma
1 Solution

niketn
Legend

@christopheryu try the following addtotals command will give you both row total and column total. You can turn off whichever you dont need by setting either row=f or col=f respectively. The labelfield and label arguments are used for column total.

<YourBaseSearch>
| stats count by router source
| xyseries router source count
| fillnull value=0
| addtotals row=t col=t labelfield=router label=Total
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@christopheryu try the following addtotals command will give you both row total and column total. You can turn off whichever you dont need by setting either row=f or col=f respectively. The labelfield and label arguments are used for column total.

<YourBaseSearch>
| stats count by router source
| xyseries router source count
| fillnull value=0
| addtotals row=t col=t labelfield=router label=Total
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

christopheryu
Communicator

| appendcols [search | stats count as TOTAL by router] worked by I like yours better as it is faster 🙂 Thank you!

0 Karma

christopheryu
Communicator

this solved it:

| stats count by router source | xyseries router source count

but I would like to add another column that would show the total count, any suggestions?

0 Karma

493669
Super Champion

try this:

...|stats values(router) as router values(*)as * by source
0 Karma

christopheryu
Communicator

thank you for response but your suggestion showed all the fields and their values by source router.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...