How to calculate count of key per each different values?

[monserta]

Hello guys, i,m new in Splunk and this is my question:

Example, i have this NetFlow data:

dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=17

dest_port=443 protoid=6
dest_port=443 protoid=17
dest_port=443 protoid=17
dest_port=443 protoid=17

I need output with count like that:

     dest_port        |         protoid          |             count

       1024                       6                               3
       1024                       17                              1
       443                        6                               1
       443                        17                              3

I mean, need count for each key with it's unique value.

Thank you.

[monserta]

It was easier that i thought, thank you a lot guys, you are all are right.

[adonio]

Hi monserta,
... | stats count by dest_port protoid

[DalJeanis]

upvote for nice demo

[monserta]

Thank you

[adayton20]

Do you mean like this?

your base search | stats count by dest_port, protoid

[monserta]

Thank you 😃

[DalJeanis · Accepted solution]

assuming they appear in your _raw data exactly as you have shown them...

| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are separated by anything else or can appear in another order...

| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...

| stats count by dest_port protoid

[monserta]

Thank you)