Splunk Search

## How can I tally a value that represents usage in 3 letters and get the number of events that have each?

New Member

I have a field lets call it usage that can up to 3 of these letters (b, n, e)
i.e. all possible logged permutations we could get are the following

1. b
2. e
3. n
4. be
5. bn
6. en
7. ben

I have a chart showing counts of these using `| stats count by usage`

what would also like to chart is total number of events that had usage with b, with e, and with n.
i.e. how many (and the percent of) events used each letter in any combo

to be able to see usage
b 5
e 170
n 34

and the percent of total events

Tags (4)
1 Solution
Esteemed Legend

Like this:

``````... | rex field=usage "(?<usage_letter>.)"
| multireport
[ stats count AS total_count | eval keep="false" ]
[ stats count BY usage_letter | eval keep="true" ]
| filldown total_count
| where keep="true"
| eval pct = 100 * count / total_count
``````
Esteemed Legend

Like this:

``````... | rex field=usage "(?<usage_letter>.)"
| multireport
[ stats count AS total_count | eval keep="false" ]
[ stats count BY usage_letter | eval keep="true" ]
| filldown total_count
| where keep="true"
| eval pct = 100 * count / total_count
``````
New Member

Thanks @woodcock this is great! I wasn't familiar with the multireport command can you explain a bit and also on how the keep is being used? I couldn't find doc on multireport

Esteemed Legend

It is not documented but it forks the results at that point and passes a copy to each `[]` stanza and then appends the results of everything together. Please do click `Accept` to close the question.

SplunkTrust

would the usage `ben` be a count of 1 each for b, e, and n and the usage `be` be counted as one each also so that the total count would be b=2, e=2, n=1?

can you post some of the raw data?

New Member

yes that is correct @marycordova
I can't really post actual events but it's would be similar to the following (I stripped out & edited lots of internal irrelevant stuff )

``````{"timestamp":"2016-07-11T23:34:35.968Z","thread":"****","level":"INFO",message":"Data CRUD: usage:be, numberOfModl:2"}

{"timestamp":"2016-07-11T23:24:51.671Z","thread":"****","level":"INFO","message":"Data CRUD: usage:b, numberOfModl:4"}

{"timestamp":"2016-07-11T22:56:35.413Z","thread":"****","level":"INFO","message":"Data CRUD: usage:bn, numberOfModl:3"}

{"timestamp":"2016-07-11T21:56:35.113Z","thread":"****","level":"INFO","message":"Data CRUD: usage:ben, numberOfModl:7"}

{"timestamp":"2016-07-11T20:16:35.113Z","thread":"****","level":"INFO","message":"Data CRUD: usage:en, numberOfModl:3"}
``````

etc..