Splunk Search

Count unique values from a text result

aionius
New Member

I have the following result from a simple query:

184.168.152.54 10.10.42.61 - - [09/Oct/2013:09:14:38 -0500] "GET /tgg/api2.php?KeyID=k207238&mode=xml&i=9780486472515 HTTP/1.1" 200 23 "-" "-" 0

How can I get the unique values of KeyID and their count?

Tags (1)
0 Karma
1 Solution

gfuente
Motivator

Hello

Try this:

sourcetype="yoursourcetype" | rex "KeyID=(?<KeyID>\w+)\&" | stats count by KeyID

Regards

View solution in original post

gfuente
Motivator

Hello

Try this:

sourcetype="yoursourcetype" | rex "KeyID=(?<KeyID>\w+)\&" | stats count by KeyID

Regards

lukejadamec
Super Champion

Try

yoursearch | stats count by KeyID

Get Updates on the Splunk Community!

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...

Raise Your Skills at the .conf25 Builder Bar: Your Splunk Developer Destination

Calling all Splunk developers, custom SPL builders, dashboarders, and Splunkbase app creators – the Builder ...

Hunt Smarter, Not Harder: Discover New SPL “Recipes” in Our Threat Hunting Webinar

Are you ready to take your threat hunting skills to the next level? As Splunk community members, you know the ...