Splunk Search

Getting top values from two fields

kennethp
Engager

I have a index that contains both destination and source countries in each entry.
I would like to get a list over top 10 countries, regardless of the source or destination.

I have tried something like this:

... | top limit=10 srccountry,dstcountry

But this doesnt work, since it shows top based on both source and destination.

Something like this I was hoping would work, but clearly doesnt

... | top limit=10 srccountry OR dstcountry

I was thinking that I could add the results from two searches and addning them, but not sure how to do this.

Does anybody knows how to solve this? (if possible)

Tags (4)
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could do something like this:

your search | eval country = srccountry . ";" . dstcountry | makemv delim=";" country | mvexpand country | top country

That will make two events for each event, one with country=srccountry and one with country=dstcountry, and then count the top ten countries.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

You could do something like this:

your search | eval country = srccountry . ";" . dstcountry | makemv delim=";" country | mvexpand country | top country

That will make two events for each event, one with country=srccountry and one with country=dstcountry, and then count the top ten countries.

Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...