Splunk Search

Distinct count by multiple fields



I'm new to splunk and kinda stuck, so any help would be greatly appreciated. What I'm trying to do is take the logs and do a count, while sorting it by multiple fields. Here's the logs:

Company Help_Desk_Agent Customer# Call_Date
John Corner Grocery 88162 1234 9/1/2012
Ma & Pa's Bait Shop 88162 9991 9/1/2012
Ma & Pa's Bait Shop 88162 9991 9/1/2012
Henry's Garage 88162 3472 9/2/2012
Marla's Bakery 99156 7885 9/2/2012
Bonnie's Boutique 99156 4001 9/3/2012
Bonnie's Boutique 34891 4001 9/3/2012
Bonnie's Boutique 34891 4001 9/4/2012

Here's what I'm trying to do:
Company Help_Desk_Agent Customer# Count
John Corner Grocery 88162 1234 1
Ma & Pa's Bait Shop 88162 9991 1
Henry's Garage 88162 3472 1
Marla's Bakery 99156 7885 1
Bonnie's Boutique 99156 4001 2

I want to take the original log and sort it by Company Name, Help_Desk_Agent, Customer Number, and the Date. I'm having a hard time grouping "Ma & Pa's Bait Shop" count into 1, since it happens in the same date .. while giving "Bonnie's Boutique a count of 2, since it happens over 2 days.


Tags (1)
0 Karma


You don't include the date in your desired output, so I'm not sure if you want to use it for your stats or not?

Anyway, this should be fairly straightforward. stats lets you perform statistical calculations split by an arbitrary number of fields. Provided you have extracted the fields properly, I'm thinking something like this should work (without the date):

... | stats count by Company,Help_Desk_Agent,Customer#

If you want to include the date in the output, but not group by it, you could use stats values():

... | stats values(Call_Date),count by Company,Help_Desk_Agent,Customer#
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...