Splunk Search

Find values for specific distinct counts

mztopp
Explorer

Hello all!

I was hoping to take a distinct count and show either the count, or if the count is 1, show the value that is being counted. For example, index=random | stats dc(src_port) AS port_count count by src_ip would populate:

src_ip    |      port_count

-----------------------------------------------------

1.2.3.4             6

2.3.4.5             (1) Port 443

3.4.5.6              4

 

Or something to this effect. Thanks!

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

There may be a few ways to do that.  Here's one.

index=random 
| stats values(src_port) AS ports count by src_ip 
| eval port_count = if(mvcount(ports)==1,"(1) Port " . mvindex(ports,0), mvcount(ports))
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There may be a few ways to do that.  Here's one.

index=random 
| stats values(src_port) AS ports count by src_ip 
| eval port_count = if(mvcount(ports)==1,"(1) Port " . mvindex(ports,0), mvcount(ports))
---
If this reply helps you, Karma would be appreciated.
0 Karma

mztopp
Explorer

Thank you!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...