Splunk Search

How to calculate count of key per each different values?

monserta
Explorer

Hello guys, i,m new in Splunk and this is my question:

Example, i have this NetFlow data:

dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=17

dest_port=443 protoid=6
dest_port=443 protoid=17
dest_port=443 protoid=17
dest_port=443 protoid=17

I need output with count like that:

     dest_port        |         protoid          |             count

       1024                       6                               3
       1024                       17                              1
       443                        6                               1
       443                        17                              3

I mean, need count for each key with it's unique value.

Thank you.

0 Karma
1 Solution

DalJeanis
Legend

assuming they appear in your _raw data exactly as you have shown them...

| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are separated by anything else or can appear in another order...

| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...

| stats count by dest_port protoid

View solution in original post

monserta
Explorer

It was easier that i thought, thank you a lot guys, you are all are right.

0 Karma

adonio
Ultra Champion

Hi monserta,
... | stats count by dest_port protoidalt text

DalJeanis
Legend

upvote for nice demo

0 Karma

monserta
Explorer

Thank you

0 Karma

adayton20
Contributor

Do you mean like this?

your base search | stats count by dest_port, protoid

monserta
Explorer

Thank you 😃

0 Karma

DalJeanis
Legend

assuming they appear in your _raw data exactly as you have shown them...

| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are separated by anything else or can appear in another order...

| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...

| stats count by dest_port protoid

monserta
Explorer

Thank you)

0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...