Frequency analysis on names in splunk

[hmi79]

Is there a built-in solution in splunk that does the frequency analysis (for ex. on domain names) ?

There is a solution by Mark Baggett in https://github.com/MarkBaggett/freq but I had problems using it in splunk.

It either can be run using the python script:

$ python3 freq.py freqtable2018.freq -m splunk.com
(6.0006, 5.0954)

Or using curl:

$ curl http://127.0.0.1:20304/measure/splunk.com

(6.0006, 5.0954)

I want to run it against a field for ex. called "query" in my zeek dns logs and calculate the frequency and save it in another field 

[yuanliu]

As always in a community forum, you get better answers by better define your use case.  Can you define "frequency analysis" in your context?  Most importantly, from what kind of source are you counting?  What result do you expect from such sources?  What is the logic between the source and the result?

You mentioned DNS logs.  Suppose your logs have a field named domain.  Do you mean to count how many queries each domain gets in unit time, say, an hour in a given search period, say, past 24 hours?

source=mydnslogs
| timechart span=1h count by domain

What other "analysis" you want to apply?  Sort by frequency?

| sort - count