Splunk Search

How do I do a stats count for 2 diffrent interesting fields?

svemurilv
Path Finder

am in a situation, I have 2 Interesting Fields Field1 has A,B values and Field2 has again A,B values I just want to generate the report like
rename the Field1-A as Mobile and Field1-B AS desktop and Field2-A as chrome and Field2-B as IE and then the report would be like

                   Desktop   |   Mobile | total      | Chrome        | IE |total
 _time   |        10      |    12    |   22        |      20       | 4  |  24

how would it possible?

0 Karma

DalJeanis
Legend

Run anywhere sample

| makeresults 
| eval mydata="Desktop,IE Desktop,Chrome Desktop,Chrome Mobile,Chrome Mobile,IE Mobile,Chrome Mobile,Chrome Mobile,Opera"
| makemv mydata 
| mvexpand mydata 
| rex field=mydata "(?<Field1>[^,]*),(?<Field2>.*)"
| rename COMMENT as "the above generates test data"

| fields Field1 Field2
| appendpipe 
     [| stats count as MyCount by Field1 
      | eval MyField="F1__".Field1 
      | table MyField MyCount 
      | addtotals row=f col=t labelfield=MyField label="F1_total" 
      | eval rectype="Summary"
      ]
| appendpipe 
    [| where isnull(rectype)|stats count as MyCount by Field2 
     | eval MyField="F2__".Field2 
     | table MyField MyCount 
     | addtotals row=f col=t labelfield=MyField label="F2_total" 
      | eval rectype="Summary"
      ]
| chart sum(MyCount) as count by rectype MyField

Notes - the lower case t on totals is required to force sorting to the right of the related columns.

0 Karma

cmerriman
Super Champion

can you share your current query and/or a sample or the data output for your two fields? it would be easier to come up with a solution if the community could see the data/query before reaching the expected output.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Break the Build: Inside the KubeDoom Lounge at .conf26

    You step up to the machine. The pixelated corridors of a certain 1993 FPS load in front of you, EMP Pulse ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...