Splunk Search

How to calculate count of key per each different values?

Explorer

Hello guys, i,m new in Splunk and this is my question:

Example, i have this NetFlow data:

dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=17

dest_port=443 protoid=6
dest_port=443 protoid=17
dest_port=443 protoid=17
dest_port=443 protoid=17

I need output with count like that:

     dest_port        |         protoid          |             count

       1024                       6                               3
       1024                       17                              1
       443                        6                               1
       443                        17                              3

I mean, need count for each key with it's unique value.

Thank you.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

assuming they appear in your _raw data exactly as you have shown them...

| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are separated by anything else or can appear in another order...

| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...

| stats count by dest_port protoid

View solution in original post

Explorer

It was easier that i thought, thank you a lot guys, you are all are right.

0 Karma

SplunkTrust
SplunkTrust

Hi monserta,
... | stats count by dest_port protoidalt text

SplunkTrust
SplunkTrust

upvote for nice demo

0 Karma

Explorer

Thank you

0 Karma

Contributor

Do you mean like this?

your base search | stats count by dest_port, protoid

Explorer

Thank you 😃

0 Karma

SplunkTrust
SplunkTrust

assuming they appear in your _raw data exactly as you have shown them...

| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are separated by anything else or can appear in another order...

| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...

| stats count by dest_port protoid

View solution in original post

Explorer

Thank you)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!