Splunk Search

Counting number of occurrences for each value in a multi-valued field

Thuan
Explorer

This is related to my DNS index. I need to search all names that start with wpad and to list all the values found.
I did this using the command

"index=dns* quest_name="wpad* | stats values(quest_name) AS WPAD

An excerpt of the results is shown below

wpad.NGIT.Northgrum.com
wpad.NGMS.Northgrum.com
wpad.Northgrum.com
....

What I need is to compute the number of times each of the preceding values, say "wpad.NGIT.Northgrum.com", appears in the search. Can it be done using a single search? Thank you.

Tags (1)
0 Karma

Thuan
Explorer

Having a count for each one of the quest_name values is the 1st step. I now need to compute the percentage of each of the computed quest_name count against the total count of all quest_name.
I can try
index=dns quest_name=wpad* | stats count(quest_name) AS Total count by quest_name AS WPAD
But this does not work.
How can these computations be done with one single search?
Thank you.

0 Karma

somesoni2
Revered Legend

What should be the expected output?

0 Karma

lguinn2
Legend

You could easily do this

index=dns quest_name=wpad* | stats count by quest_name | rename quest_name as WPAD
0 Karma
Get Updates on the Splunk Community!

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...