Splunk Search

How do I do a stats count for 2 diffrent interesting fields?

svemurilv
Path Finder

am in a situation, I have 2 Interesting Fields Field1 has A,B values and Field2 has again A,B values I just want to generate the report like
rename the Field1-A as Mobile and Field1-B AS desktop and Field2-A as chrome and Field2-B as IE and then the report would be like

                   Desktop   |   Mobile | total      | Chrome        | IE |total
 _time   |        10      |    12    |   22        |      20       | 4  |  24

how would it possible?

0 Karma

DalJeanis
Legend

Run anywhere sample

| makeresults 
| eval mydata="Desktop,IE Desktop,Chrome Desktop,Chrome Mobile,Chrome Mobile,IE Mobile,Chrome Mobile,Chrome Mobile,Opera"
| makemv mydata 
| mvexpand mydata 
| rex field=mydata "(?<Field1>[^,]*),(?<Field2>.*)"
| rename COMMENT as "the above generates test data"

| fields Field1 Field2
| appendpipe 
     [| stats count as MyCount by Field1 
      | eval MyField="F1__".Field1 
      | table MyField MyCount 
      | addtotals row=f col=t labelfield=MyField label="F1_total" 
      | eval rectype="Summary"
      ]
| appendpipe 
    [| where isnull(rectype)|stats count as MyCount by Field2 
     | eval MyField="F2__".Field2 
     | table MyField MyCount 
     | addtotals row=f col=t labelfield=MyField label="F2_total" 
      | eval rectype="Summary"
      ]
| chart sum(MyCount) as count by rectype MyField

Notes - the lower case t on totals is required to force sorting to the right of the related columns.

0 Karma

cmerriman
Super Champion

can you share your current query and/or a sample or the data output for your two fields? it would be easier to come up with a solution if the community could see the data/query before reaching the expected output.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...