Splunk Search

How to achieve distinct count across multiple fields?

robert2138
Engager

How to get a distinct count across two different fields. I have webserver request logs containing browser family and IP address – so should be able to get a count of different & distinct user-browsers by browser family – i.e. how many different users are using Safari for example. But piping into:

stats dc(ua_family,cp_ip) by ua_family

… doesn’t do it - I get a distinct list of browser families but zero counts. But concatenating the fields:

eval comb=c_ip.ua_family | stats dc(comb) by ua_family

…does work. Is there a way to do it without concatenating?
So why didn’t the dc on the two separate fields work?

Labels (1)
Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

i am not actually sure what you are asking to count, but either ... | stats dc(c_ip) by ua_family or ... | stats count by ua_family,c_ip may be what you want. if not, perhaps you could clarify as i don't think i understand what you're looking for.

View solution in original post

nick405060
Motivator

Credit goes to @micahkemp:

| stats dc(eval(mvappend(field1, field2, field3)))

weezeee
Engager

Not sure if it helps but in my case, I have some stats that require me to look at combination of clients services, and the intersection (some clients are using some services, but not others). I needed to do some stats for distinct client, service, and the client-service contracts. My raw data already have the field of each transaction with name of the client and service they have. I can get that by creating a new field, CONTRACT, which is simply a concatenation of client and service, then I can do a distinct count on it:

| stats count by CLIENT SERVICE | eval CONTRACT = CLIENT . "-" . SERVICE | stats dc(SERVICE) dc(CLIENT) dc(CONTRACT)

gfuente
Motivator

Hello

You could use dedup to get only 1 event per combination of user agent and ip and then make a regular count:

... | dedup ua_family cp_ip | stats count

Regards

gkanapathy
Splunk Employee
Splunk Employee

i am not actually sure what you are asking to count, but either ... | stats dc(c_ip) by ua_family or ... | stats count by ua_family,c_ip may be what you want. if not, perhaps you could clarify as i don't think i understand what you're looking for.

linu1988
Champion

May be dc doesn't work on multiple fields..

you can get it like this:
| stats distinct_count(ua_family) ua_ip dd by ua_family,cp_ip|stats count(ua_ip)

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...