Splunk Search
Highlighted

How to add the count of two different fields' values?

New Member

For example:

|stats count by src_ip

src_ip count
1.1.1.1 100
2.2.2.2 200
3.3.3.3 300

|stats count by dst_ip

dst_ip count
1.1.1.1 200
2.2.2.2 300
3.3.3.3 400

On these conditions, I wan to create the table

ip_addr count
1.1.1.1 300
2.2.2.2 500
3.3.3.3 700

How can I create the table?

0 Karma
Highlighted

Re: How to add the count of two different fields' values?

Legend

Assuming both fields exist on each event, try this

.... | eval ip=src_ip.",".dst_ip | makemv ip delim="," | mvexpand ip | stats count by ip

View solution in original post

0 Karma
Highlighted

Re: How to add the count of two different fields' values?

New Member

I could do it!
Thanks a lot bro 🙂

0 Karma