Splunk Search

How do I do a stats count for 2 diffrent interesting fields?

svemurilv
Path Finder

am in a situation, I have 2 Interesting Fields Field1 has A,B values and Field2 has again A,B values I just want to generate the report like
rename the Field1-A as Mobile and Field1-B AS desktop and Field2-A as chrome and Field2-B as IE and then the report would be like

                   Desktop   |   Mobile | total      | Chrome        | IE |total
 _time   |        10      |    12    |   22        |      20       | 4  |  24

how would it possible?

0 Karma

DalJeanis
Legend

Run anywhere sample

| makeresults 
| eval mydata="Desktop,IE Desktop,Chrome Desktop,Chrome Mobile,Chrome Mobile,IE Mobile,Chrome Mobile,Chrome Mobile,Opera"
| makemv mydata 
| mvexpand mydata 
| rex field=mydata "(?<Field1>[^,]*),(?<Field2>.*)"
| rename COMMENT as "the above generates test data"

| fields Field1 Field2
| appendpipe 
     [| stats count as MyCount by Field1 
      | eval MyField="F1__".Field1 
      | table MyField MyCount 
      | addtotals row=f col=t labelfield=MyField label="F1_total" 
      | eval rectype="Summary"
      ]
| appendpipe 
    [| where isnull(rectype)|stats count as MyCount by Field2 
     | eval MyField="F2__".Field2 
     | table MyField MyCount 
     | addtotals row=f col=t labelfield=MyField label="F2_total" 
      | eval rectype="Summary"
      ]
| chart sum(MyCount) as count by rectype MyField

Notes - the lower case t on totals is required to force sorting to the right of the related columns.

0 Karma

cmerriman
Super Champion

can you share your current query and/or a sample or the data output for your two fields? it would be easier to come up with a solution if the community could see the data/query before reaching the expected output.

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...