Splunk Search

Count number of field value per source and show as table

Communicator

I have a field named "router" that has multiple values and have three sources. I would like to count the router values for each source and put them in a table.

So the three "source" values are syslogs, enviro and triggers and "router" have multiple values (e.g, ABCD, EFGH, KLMN). I would like to put in a table the total count of distinct "router" value for each source as shown below:

router syslog enviro triggers
ABCD 3 4 8
EFGH 2 5 9
KLMN 3 7 8

thank you in advance!

0 Karma
1 Solution

Legend

@christopheryu try the following addtotals command will give you both row total and column total. You can turn off whichever you dont need by setting either row=f or col=f respectively. The labelfield and label arguments are used for column total.

<YourBaseSearch>
| stats count by router source
| xyseries router source count
| fillnull value=0
| addtotals row=t col=t labelfield=router label=Total
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Legend

@christopheryu try the following addtotals command will give you both row total and column total. You can turn off whichever you dont need by setting either row=f or col=f respectively. The labelfield and label arguments are used for column total.

<YourBaseSearch>
| stats count by router source
| xyseries router source count
| fillnull value=0
| addtotals row=t col=t labelfield=router label=Total
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

Communicator

| appendcols [search | stats count as TOTAL by router] worked by I like yours better as it is faster 🙂 Thank you!

0 Karma

Communicator

this solved it:

| stats count by router source | xyseries router source count

but I would like to add another column that would show the total count, any suggestions?

0 Karma

Super Champion

try this:

...|stats values(router) as router values(*)as * by source
0 Karma

Communicator

thank you for response but your suggestion showed all the fields and their values by source router.

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes and swag!