Splunk Search

How do I get a distinct value count from two fields?

twh1
Communicator

I have two different fields (DB_INSTANCE_NAME & INSTANCE_NAME ) in two source types. These fields contain a similar value. I want distinct counts after combining both pieces of field data.

DB_INSTANCE_NAME= ansrp, flexp, sunopt, vlprod, buybprod, FDPOSPRD, aasprod, dcpscp, hydra, cidprod,  gcdprd, pspprod, HDMPRD
INSTANCE_NAME= obieep, cnavprd, gcdprd, pspprod, svdprod, tumss2, fepauth, rulesu, ecmsprod, HDMPRD, csprod, RFEP1, pcip, vlprod

I want the count of ansrp, flexp, sunopt, vlprod, buybprod, FDPOSPRD, aasprod, dcpscp, hydra, cidprod, gcdprd, pspprod, HDMPRD, obieep, cnavprd, svdprod, tumss2, fepauth, rulesu, ecmsprod, HDMPRD, csprod, RFEP1, pcip

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

What you do is combine them then count them.

index=foo (sourcetype=st1 OR sourcetype=st2) | eval combinedField=coalesce(DB_INSTANCE_NAME, INSTANCE_NAME) | stats dc(combinedField) as Count
---
If this reply helps you, Karma would be appreciated.

View solution in original post

nick405060
Motivator

Credit goes to @micahkemp:

| stats dc(eval(mvappend(field1, field2, field3)))

richgalloway
SplunkTrust
SplunkTrust

What you do is combine them then count them.

index=foo (sourcetype=st1 OR sourcetype=st2) | eval combinedField=coalesce(DB_INSTANCE_NAME, INSTANCE_NAME) | stats dc(combinedField) as Count
---
If this reply helps you, Karma would be appreciated.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Monitoring AI Agents with Splunk Observability Cloud

Let’s say I’m running a travel planning AI app in production. A user asks for three concise hotel options in ...

[Puzzles] Solve, Learn, Repeat: Tiling

This puzzle (first published here) is based on finding groups of tessellated tiles (inspired by floor tiles I ...

SOK it to Me: Top 3 Benefits of Using Splunk Operator on Kubernetes that’ll Make ...

    Thursday, July 9, 2026  |  11:00AM–12:00PM PDT Duration: 1 hour (includes Q&A) Managing can feel like a ...