Splunk Search

How do I count and sum multivalue fields by another multivalue field?

Log_wrangler
Builder

Hi,

I am hitting a dead end with my search...

I have two multivalue fields:

Site_ID - has 100's of values
Attack - has 10 values

I want a report that shows the count of individual attacks and total attacks by Site_ID

Site_ID                     XSS         SQLi    Total by Site
my.site.com              10           12         24

I have been using this as a base search

index=Firewall sourcetype=Firewall_logs
Attack = SQLi OR
Attack = xSS OR
| chart count over Site_ID by Attack

But I just cannot find the right syntax to produce the needed report.

Any help would be greatly appreciated!

0 Karma
1 Solution

woodcock
Esteemed Legend

The stats, chart, and timechart commands are all multi-value-safe so all that you need is a total column? That is cake, just add | addtotals row=t col=f fieldname="Total by Site". See this run-anywhere example:

index=_* 
| rename sourcetype AS Attack, host AS Site_ID 
| chart count OVER Site_ID BY Attack
| addtotals row=t col=f fieldname="Total by Site"

View solution in original post

0 Karma

woodcock
Esteemed Legend

The stats, chart, and timechart commands are all multi-value-safe so all that you need is a total column? That is cake, just add | addtotals row=t col=f fieldname="Total by Site". See this run-anywhere example:

index=_* 
| rename sourcetype AS Attack, host AS Site_ID 
| chart count OVER Site_ID BY Attack
| addtotals row=t col=f fieldname="Total by Site"
0 Karma

Log_wrangler
Builder

Thanks, you're right... cake, forgot how to do it.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...