Splunk Search

Create unique field counts from comma deliminated line

chablist
New Member

I have a log file that always has the same structure of:
time1,time2,groupNumber

eg:
355350224,338837556,2
1355350228,338837557,2
1355312572,338828143,4
1355350212,338837553,4
1355350216,338837554,4
1355350220,338837555,4
1355350224,338837556,4
1355310304,338827576,5

I want to perform a search such that i can get a count for each of the unique groupNumbers for a report to be able to return something like:

2: 2
4: 5
5: 1

Tags (1)
0 Karma

sowings
Splunk Employee
Splunk Employee

Sounds like the distinct_count function of stats. Or perhaps just count:

<your search here> | stats count by groupNumber
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...