Distinct count by multiple fields

[lauj]

Hi,

I'm new to splunk and kinda stuck, so any help would be greatly appreciated. What I'm trying to do is take the logs and do a count, while sorting it by multiple fields. Here's the logs:

Company Help_Desk_Agent Customer# Call_Date
John Corner Grocery 88162 1234 9/1/2012
Ma & Pa's Bait Shop 88162 9991 9/1/2012
Ma & Pa's Bait Shop 88162 9991 9/1/2012
Henry's Garage 88162 3472 9/2/2012
Marla's Bakery 99156 7885 9/2/2012
Bonnie's Boutique 99156 4001 9/3/2012
Bonnie's Boutique 34891 4001 9/3/2012
Bonnie's Boutique 34891 4001 9/4/2012

Here's what I'm trying to do:
Company Help_Desk_Agent Customer# Count
John Corner Grocery 88162 1234 1
Ma & Pa's Bait Shop 88162 9991 1
Henry's Garage 88162 3472 1
Marla's Bakery 99156 7885 1
Bonnie's Boutique 99156 4001 2

I want to take the original log and sort it by Company Name, Help_Desk_Agent, Customer Number, and the Date. I'm having a hard time grouping "Ma & Pa's Bait Shop" count into 1, since it happens in the same date .. while giving "Bonnie's Boutique a count of 2, since it happens over 2 days.

Thanks!

[Ayn]

You don't include the date in your desired output, so I'm not sure if you want to use it for your stats or not?

Anyway, this should be fairly straightforward. stats lets you perform statistical calculations split by an arbitrary number of fields. Provided you have extracted the fields properly, I'm thinking something like this should work (without the date):

... | stats count by Company,Help_Desk_Agent,Customer#

If you want to include the date in the output, but not group by it, you could use stats values():

... | stats values(Call_Date),count by Company,Help_Desk_Agent,Customer#