Splunk Search

Distinct count by multiple fields



I'm new to splunk and kinda stuck, so any help would be greatly appreciated. What I'm trying to do is take the logs and do a count, while sorting it by multiple fields. Here's the logs:

Company Help_Desk_Agent Customer# Call_Date
John Corner Grocery 88162 1234 9/1/2012
Ma & Pa's Bait Shop 88162 9991 9/1/2012
Ma & Pa's Bait Shop 88162 9991 9/1/2012
Henry's Garage 88162 3472 9/2/2012
Marla's Bakery 99156 7885 9/2/2012
Bonnie's Boutique 99156 4001 9/3/2012
Bonnie's Boutique 34891 4001 9/3/2012
Bonnie's Boutique 34891 4001 9/4/2012

Here's what I'm trying to do:
Company Help_Desk_Agent Customer# Count
John Corner Grocery 88162 1234 1
Ma & Pa's Bait Shop 88162 9991 1
Henry's Garage 88162 3472 1
Marla's Bakery 99156 7885 1
Bonnie's Boutique 99156 4001 2

I want to take the original log and sort it by Company Name, Help_Desk_Agent, Customer Number, and the Date. I'm having a hard time grouping "Ma & Pa's Bait Shop" count into 1, since it happens in the same date .. while giving "Bonnie's Boutique a count of 2, since it happens over 2 days.


Tags (1)
0 Karma


You don't include the date in your desired output, so I'm not sure if you want to use it for your stats or not?

Anyway, this should be fairly straightforward. stats lets you perform statistical calculations split by an arbitrary number of fields. Provided you have extracted the fields properly, I'm thinking something like this should work (without the date):

... | stats count by Company,Help_Desk_Agent,Customer#

If you want to include the date in the output, but not group by it, you could use stats values():

... | stats values(Call_Date),count by Company,Help_Desk_Agent,Customer#
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...