Splunk Search

Create unique field counts from comma deliminated line

chablist
New Member

I have a log file that always has the same structure of:
time1,time2,groupNumber

eg:
355350224,338837556,2
1355350228,338837557,2
1355312572,338828143,4
1355350212,338837553,4
1355350216,338837554,4
1355350220,338837555,4
1355350224,338837556,4
1355310304,338827576,5

I want to perform a search such that i can get a count for each of the unique groupNumbers for a report to be able to return something like:

2: 2
4: 5
5: 1

Tags (1)
0 Karma
1 Solution

Ayn
Legend
... | stats count by groupNumber

View solution in original post

0 Karma

Ayn
Legend
... | stats count by groupNumber
0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...