Splunk Search

Count of multiple unique events per field

larunrahul
Observer

Hi Folks,

 

I have two types of events that look like this

Type1:

TXN_ID=abcd inbound call INGRESS

Type2:

TXN_ID=abcd inbound call EGRESS

 

i want to find out how many events of each type per TXN_ID. If the counts per type don't match per TXN_ID, I want to out put that TXN_ID

 

I know that we can do stats count by TXN_ID. But how do so do that Per event type in same query?

 

Appreciate the help.

 

Thanks

Labels (4)
0 Karma

tscroggins
Influencer

Hi @larunrahul,

You can use the rex, chart, and where commands to extract the call type, summarize the events, and filter the results, respectively:

| makeresults format=csv data="_raw
TXN_ID=abcd inbound call INGRESS
TXN_ID=abcd inbound call EGRESS
TXN_ID=efgh inbound call INGRESS" 
| extract 
| rex "inbound call (?<call_type>[^\\s]+)" 
| chart count over TXN_ID by call_type 
| where INGRESS!=EGRESS
TXN_ID	EGRESS	INGRESS
efgh         0        1

I've used the extract command to automatically extract the TXN_ID field in the example, but if your events are already indexed, Splunk will have done that for you automatically.

Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...