I need to add more columns to a search after results are counted. Here's my query
index=wineventlog EventCode=4740 host=* | stats count by Account_Name | sort - count
Results give me Account_Name and Count ...I want to add more fields to results.I tried table but this doesn't work.
You could try using the eventstats command instead of stats.
Per Splunk Docs,
The eventstats command is similar to the stats command. The difference is that with the eventstats command aggregation results are added inline to each event and added only if the aggregation is pertinent to that event.
When you pipe to stats you are doing a transforming search and in effect dropping the data that isn't part of the statistical results.
In order to include additional fields you need to include them as part of the results. You could also try something like appendpipe to add more output to your base search.
When you do
count by, stats will count the times when the combination of fields appears together, otherwise it will throw away the field if it is not specified in your
Say you have this data
1 host=host1 field="test"
2 host=host1 field="test2"
And my search is:
* | stats count by host field
I'll have 2 results, each with the count of 1. One result for host1, test and one result for host1, test2.
What does your data look like, if you have a lot of unique events, stats may not be the best way to characterize your data.
I just really want to group the Account_Name field into individual lines with a count. But I want to see multiple fields, like Computer Name , which may be different for example:
Account_Name Computer name IP
account Computer 1 10.10.0.1
account Computer 2 10.10.0.2
account Computer 3 10.10.0.3
what I'd like to see is just a grouping and count of "Account_Name" and show other fields as well:
Account_Name Computer name IP Count
account Computer 1 10.10.0.1 3
account Computer 2 10.10.0.2 3
account Computer 3 10.10.0.3 3
index=wineventlog EventCode=4740 host=* | stats count by Account_Name, Computer_Name, IP | stats list(Computer_Name) as Computer_Name, list(IP) as IP, count(Account_Name) as Count by Account_Name | sort - Count
@jcolon68, this groups Account_Names together and still counts them.
So you want to count the account names by multiple fields while still showing the account name?
Have you tried something like:
index=wineventlog EventCode=4740 host=* | stats c(Account_Name) as COUNT by Account_Name, ComputerName, IP