Splunk Search

How to add the count of two different fields' values?

i111040d
New Member

For example:

|stats count by src_ip

src_ip count
1.1.1.1 100
2.2.2.2 200
3.3.3.3 300

|stats count by dst_ip

dst_ip count
1.1.1.1 200
2.2.2.2 300
3.3.3.3 400

On these conditions, I wan to create the table

ip_addr count
1.1.1.1 300
2.2.2.2 500
3.3.3.3 700

How can I create the table?

0 Karma
1 Solution

sundareshr
Legend

Assuming both fields exist on each event, try this

.... | eval ip=src_ip.",".dst_ip | makemv ip delim="," | mvexpand ip | stats count by ip

View solution in original post

0 Karma

sundareshr
Legend

Assuming both fields exist on each event, try this

.... | eval ip=src_ip.",".dst_ip | makemv ip delim="," | mvexpand ip | stats count by ip
0 Karma

i111040d
New Member

I could do it!
Thanks a lot bro :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...