Splunk Search

Count values of grouped key

dav_muel
Engager

I have logs like this:

user=userA ip=1.1.1.1 ...
user=userA ip=1.1.1.2 ...
user=userB ip=1.1.2.1 ...
user=userB ip=1.1.2.1 ...
user=userC ip=1.1.3.1 ...
user=userC ip=1.1.3.2 ...
user=userC ip=1.1.3.3 ...

Now I want to have a list of all users with their IPs and the count of the different IPs.

First I do this:

======
search foobar
| stats values(user) by ip
======

Result is:

userA1.1.1.1
1.1.1.2
userB1.1.2.1
userC1.1.3.1
1.1.3.2
1.1.3.3

 

How do I count and display the IPs? It should look like this:

userA1.1.1.1
1.1.1.2
2
userB1.1.2.11
userC1.1.3.1
1.1.3.2
1.1.3.3
 3
Labels (2)
0 Karma
1 Solution

rnowitzki
Builder

Hi @dav_muel ,

This should work:

search foobar
| stats values(ip) as ips by user
| eval ipcount=mvcount(ips)

 
BR
Ralph

--
Karma and/or Solution tagging appreciated.

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

 

base search | stats dc(ip) as IP_COUNT values(ip) as ip_list by User

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

somesoni2
Revered Legend

You can call multiple function in stats. Like this

 

search foobar
| stats values(ip) as ips_used dc(ips) as ips_count by user
0 Karma

rnowitzki
Builder

Hi @dav_muel ,

This should work:

search foobar
| stats values(ip) as ips by user
| eval ipcount=mvcount(ips)

 
BR
Ralph

--
Karma and/or Solution tagging appreciated.
0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...