Splunk Search

How do you count multiple fields with the stats count command?

Spiere
Path Finder

Hey guys,

Question for you. I have a query where I am searching for multiple field names inside of the query - sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found" is it possible to use stats count in order to count up each of the fields?

Something like sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found" | stats count by PhpFatal, DrupalPHPFatal, AccessDenied, PageNotFound

Is this possible?

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

Sure! But it depends on how your events look, i.e. if one event can contain more than one of your fields or whether they are mutually exclusive in one event. If one event can only ever contain one of those fields, you can use this command:

sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found"
| eval message=coalesce(PhpFatal, DrupalPHPFatal, AccessDenied, PageNotFound)
| stats count by message

The first command will create a new field named "message", and depending on which of the other fields the event contains it will use the data from that field as its content.

If your events can contain more than one of the initial fields, you can do this:

sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found"
| eval helper=PhpFatal.";".DrupalPHPFatal.";".AccessDenied.";".PageNotFound
| makemv delim=";" helper
| stats count by helper

The eval command will again create a new field, "helper", which is just a concatenation of all the other fields delimited by ;. The next command creates a multivalue field based on the delimiter, which prepares the field for counting by the stats command.

Keep in mind that the latter method will produce overlapping counts, i.e. if you have 20 original events and 10 of them have two of your fields, the sum of your stats will show 30.

View solution in original post

gyslainlatsa
Motivator

hi Spiere,

it is not possible, try looks the description at the use of the command stats: Each time you invoke the stats command, you can use more than one function. However, you can only use one by clause.

For mor informations, follow this link:

docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats

richgalloway
SplunkTrust
SplunkTrust

The OP's suggested stats command uses a single by clause so it is syntactically correct.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jeffland
SplunkTrust
SplunkTrust

Sure! But it depends on how your events look, i.e. if one event can contain more than one of your fields or whether they are mutually exclusive in one event. If one event can only ever contain one of those fields, you can use this command:

sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found"
| eval message=coalesce(PhpFatal, DrupalPHPFatal, AccessDenied, PageNotFound)
| stats count by message

The first command will create a new field named "message", and depending on which of the other fields the event contains it will use the data from that field as its content.

If your events can contain more than one of the initial fields, you can do this:

sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found"
| eval helper=PhpFatal.";".DrupalPHPFatal.";".AccessDenied.";".PageNotFound
| makemv delim=";" helper
| stats count by helper

The eval command will again create a new field, "helper", which is just a concatenation of all the other fields delimited by ;. The next command creates a multivalue field based on the delimiter, which prepares the field for counting by the stats command.

Keep in mind that the latter method will produce overlapping counts, i.e. if you have 20 original events and 10 of them have two of your fields, the sum of your stats will show 30.

Spiere
Path Finder

thanks! The first command worked well for me since they were all separate fields.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...