How do you count multiple fields with the stats count command?

[Spiere]

Hey guys,

Question for you. I have a query where I am searching for multiple field names inside of the query - sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found" is it possible to use stats count in order to count up each of the fields?

Something like sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found" | stats count by PhpFatal, DrupalPHPFatal, AccessDenied, PageNotFound

Is this possible?

[gyslainlatsa]

hi Spiere,

it is not possible, try looks the description at the use of the command stats: Each time you invoke the stats command, you can use more than one function. However, you can only use one by clause.

For mor informations, follow this link:

docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats

[richgalloway]

The OP's suggested stats command uses a single by clause so it is syntactically correct.

[jeffland · Accepted solution]

Sure! But it depends on how your events look, i.e. if one event can contain more than one of your fields or whether they are mutually exclusive in one event. If one event can only ever contain one of those fields, you can use this command:

sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found"
| eval message=coalesce(PhpFatal, DrupalPHPFatal, AccessDenied, PageNotFound)
| stats count by message

The first command will create a new field named "message", and depending on which of the other fields the event contains it will use the data from that field as its content.

If your events can contain more than one of the initial fields, you can do this:

sourcetype=testing PhpFatal="PHP Fatal error" OR DrupalPHPFatal="Error: PHP FATAL Error" OR AccessDenied="Access Denied" OR PageNotFound="page not found"
| eval helper=PhpFatal.";".DrupalPHPFatal.";".AccessDenied.";".PageNotFound
| makemv delim=";" helper
| stats count by helper

The eval command will again create a new field, "helper", which is just a concatenation of all the other fields delimited by ;. The next command creates a multivalue field based on the delimiter, which prepares the field for counting by the stats command.

Keep in mind that the latter method will produce overlapping counts, i.e. if you have 20 original events and 10 of them have two of your fields, the sum of your stats will show 30.

[Spiere]

thanks! The first command worked well for me since they were all separate fields.