Splunk Search

Extract count of each value of a field and create a timechart from it using stats

priyangshupal
Engager

I have a field "skill" which takes multiple values:

Screenshot 2021-10-29 at 12.18.53 PM.png

I want to extract the count of each of the values of skill and store each of them in variables.

Say v1,v2,v3,v5 etc:

where their values are

v1 = 181

v2 = 144

v3 = 80

and so on.

Labels (2)
0 Karma

tread_splunk
Splunk Employee
Splunk Employee

But if you really want to introduce the V1, V2, V3 field names you'll need...

index=_* index=_internal sourcetype=splunkd 
| rename component as skill 
| timechart span=5m count by skill limit=0 
| untable _time skill count 
| sort skill, _time 
| streamstats dc(skill) as counter 
| eval fieldnameReq="v".counter 
| timechart span=5m sum(count) by fieldnameReq limit=0

 

0 Karma

tread_splunk
Splunk Employee
Splunk Employee

I think this is what you mean.  The hardest part is introducing the v1,v2,v3 etc field names.

If you're happy to retain the skill values, i.e. F1, F2, F3 (in your screenshot above) as the field names, then this becomes much simpler i.e....

index=_* index=_internal sourcetype=splunkd 
| rename component as skill 
| timechart span=5m count by skill limit=0 
0 Karma

tread_splunk
Splunk Employee
Splunk Employee

Something like this...

index=_* index=_internal sourcetype=splunkd 
| rename component as skill 
| stats count by skill 
| streamstats count as counter 
| eval fieldnameReq="v".counter,stub="sum" 
| chart sum(count) over stub by fieldnameReq limit=0 
| fields - stub

Replace first 2 lines with your query.  Working on another post that produces a timechart.  2 tics

0 Karma

tread_splunk
Splunk Employee
Splunk Employee

Neater solution, using transpose command.

index=_* index=_internal sourcetype=splunkd 
| rename component as skill 
| stats count by skill 
| streamstats count as counter 
| eval fieldnameReq="v".counter 
| fields - counter skill 
| transpose header_field=fieldnameReq
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>