Splunk Search

How do you count multiple fields with the stats count command?

Spiere
Path Finder

Hey guys,

Question for you. I have a query where I am searching for multiple field names inside of the query - sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found" is it possible to use stats count in order to count up each of the fields?

Something like sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found" | stats count by PhpFatal, DrupalPHPFatal, AccessDenied, PageNotFound

Is this possible?

0 Karma
1 Solution

jeffland
SplunkTrust
SplunkTrust

Sure! But it depends on how your events look, i.e. if one event can contain more than one of your fields or whether they are mutually exclusive in one event. If one event can only ever contain one of those fields, you can use this command:

sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found"
| eval message=coalesce(PhpFatal, DrupalPHPFatal, AccessDenied, PageNotFound)
| stats count by message

The first command will create a new field named "message", and depending on which of the other fields the event contains it will use the data from that field as its content.

If your events can contain more than one of the initial fields, you can do this:

sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found"
| eval helper=PhpFatal.";".DrupalPHPFatal.";".AccessDenied.";".PageNotFound
| makemv delim=";" helper
| stats count by helper

The eval command will again create a new field, "helper", which is just a concatenation of all the other fields delimited by ;. The next command creates a multivalue field based on the delimiter, which prepares the field for counting by the stats command.

Keep in mind that the latter method will produce overlapping counts, i.e. if you have 20 original events and 10 of them have two of your fields, the sum of your stats will show 30.

View solution in original post

gyslainlatsa
Motivator

hi Spiere,

it is not possible, try looks the description at the use of the command stats: Each time you invoke the stats command, you can use more than one function. However, you can only use one by clause.

For mor informations, follow this link:

docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats

richgalloway
SplunkTrust
SplunkTrust

The OP's suggested stats command uses a single by clause so it is syntactically correct.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jeffland
SplunkTrust
SplunkTrust

Sure! But it depends on how your events look, i.e. if one event can contain more than one of your fields or whether they are mutually exclusive in one event. If one event can only ever contain one of those fields, you can use this command:

sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found"
| eval message=coalesce(PhpFatal, DrupalPHPFatal, AccessDenied, PageNotFound)
| stats count by message

The first command will create a new field named "message", and depending on which of the other fields the event contains it will use the data from that field as its content.

If your events can contain more than one of the initial fields, you can do this:

sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found"
| eval helper=PhpFatal.";".DrupalPHPFatal.";".AccessDenied.";".PageNotFound
| makemv delim=";" helper
| stats count by helper

The eval command will again create a new field, "helper", which is just a concatenation of all the other fields delimited by ;. The next command creates a multivalue field based on the delimiter, which prepares the field for counting by the stats command.

Keep in mind that the latter method will produce overlapping counts, i.e. if you have 20 original events and 10 of them have two of your fields, the sum of your stats will show 30.

Spiere
Path Finder

thanks! The first command worked well for me since they were all separate fields.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

 Are you ready to revolutionize your IT operations? As digital transformation accelerates, the demand for ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...