Splunk Search

How do I do a stats count for 2 diffrent interesting fields?

svemurilv
Path Finder

am in a situation, I have 2 Interesting Fields Field1 has A,B values and Field2 has again A,B values I just want to generate the report like
rename the Field1-A as Mobile and Field1-B AS desktop and Field2-A as chrome and Field2-B as IE and then the report would be like

                   Desktop   |   Mobile | total      | Chrome        | IE |total
 _time   |        10      |    12    |   22        |      20       | 4  |  24

how would it possible?

0 Karma

DalJeanis
Legend

Run anywhere sample

| makeresults 
| eval mydata="Desktop,IE Desktop,Chrome Desktop,Chrome Mobile,Chrome Mobile,IE Mobile,Chrome Mobile,Chrome Mobile,Opera"
| makemv mydata 
| mvexpand mydata 
| rex field=mydata "(?<Field1>[^,]*),(?<Field2>.*)"
| rename COMMENT as "the above generates test data"

| fields Field1 Field2
| appendpipe 
     [| stats count as MyCount by Field1 
      | eval MyField="F1__".Field1 
      | table MyField MyCount 
      | addtotals row=f col=t labelfield=MyField label="F1_total" 
      | eval rectype="Summary"
      ]
| appendpipe 
    [| where isnull(rectype)|stats count as MyCount by Field2 
     | eval MyField="F2__".Field2 
     | table MyField MyCount 
     | addtotals row=f col=t labelfield=MyField label="F2_total" 
      | eval rectype="Summary"
      ]
| chart sum(MyCount) as count by rectype MyField

Notes - the lower case t on totals is required to force sorting to the right of the related columns.

0 Karma

cmerriman
Super Champion

can you share your current query and/or a sample or the data output for your two fields? it would be easier to come up with a solution if the community could see the data/query before reaching the expected output.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...