Splunk Search

Distinct count by multiple fields

lauj
Observer

Hi,

I'm new to splunk and kinda stuck, so any help would be greatly appreciated. What I'm trying to do is take the logs and do a count, while sorting it by multiple fields. Here's the logs:

Company Help_Desk_Agent Customer# Call_Date
John Corner Grocery 88162 1234 9/1/2012
Ma & Pa's Bait Shop 88162 9991 9/1/2012
Ma & Pa's Bait Shop 88162 9991 9/1/2012
Henry's Garage 88162 3472 9/2/2012
Marla's Bakery 99156 7885 9/2/2012
Bonnie's Boutique 99156 4001 9/3/2012
Bonnie's Boutique 34891 4001 9/3/2012
Bonnie's Boutique 34891 4001 9/4/2012

Here's what I'm trying to do:
Company Help_Desk_Agent Customer# Count
John Corner Grocery 88162 1234 1
Ma & Pa's Bait Shop 88162 9991 1
Henry's Garage 88162 3472 1
Marla's Bakery 99156 7885 1
Bonnie's Boutique 99156 4001 2

I want to take the original log and sort it by Company Name, Help_Desk_Agent, Customer Number, and the Date. I'm having a hard time grouping "Ma & Pa's Bait Shop" count into 1, since it happens in the same date .. while giving "Bonnie's Boutique a count of 2, since it happens over 2 days.

Thanks!

Tags (1)
0 Karma

Ayn
Legend

You don't include the date in your desired output, so I'm not sure if you want to use it for your stats or not?

Anyway, this should be fairly straightforward. stats lets you perform statistical calculations split by an arbitrary number of fields. Provided you have extracted the fields properly, I'm thinking something like this should work (without the date):

... | stats count by Company,Help_Desk_Agent,Customer#

If you want to include the date in the output, but not group by it, you could use stats values():

... | stats values(Call_Date),count by Company,Help_Desk_Agent,Customer#
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...