Splunk Search

Distinct count by multiple fields

lauj
Observer

Hi,

I'm new to splunk and kinda stuck, so any help would be greatly appreciated. What I'm trying to do is take the logs and do a count, while sorting it by multiple fields. Here's the logs:

Company Help_Desk_Agent Customer# Call_Date
John Corner Grocery 88162 1234 9/1/2012
Ma & Pa's Bait Shop 88162 9991 9/1/2012
Ma & Pa's Bait Shop 88162 9991 9/1/2012
Henry's Garage 88162 3472 9/2/2012
Marla's Bakery 99156 7885 9/2/2012
Bonnie's Boutique 99156 4001 9/3/2012
Bonnie's Boutique 34891 4001 9/3/2012
Bonnie's Boutique 34891 4001 9/4/2012

Here's what I'm trying to do:
Company Help_Desk_Agent Customer# Count
John Corner Grocery 88162 1234 1
Ma & Pa's Bait Shop 88162 9991 1
Henry's Garage 88162 3472 1
Marla's Bakery 99156 7885 1
Bonnie's Boutique 99156 4001 2

I want to take the original log and sort it by Company Name, Help_Desk_Agent, Customer Number, and the Date. I'm having a hard time grouping "Ma & Pa's Bait Shop" count into 1, since it happens in the same date .. while giving "Bonnie's Boutique a count of 2, since it happens over 2 days.

Thanks!

Tags (1)
0 Karma

Ayn
Legend

You don't include the date in your desired output, so I'm not sure if you want to use it for your stats or not?

Anyway, this should be fairly straightforward. stats lets you perform statistical calculations split by an arbitrary number of fields. Provided you have extracted the fields properly, I'm thinking something like this should work (without the date):

... | stats count by Company,Help_Desk_Agent,Customer#

If you want to include the date in the output, but not group by it, you could use stats values():

... | stats values(Call_Date),count by Company,Help_Desk_Agent,Customer#
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...