Splunk Search

How to calculate count of key per each different values?

Explorer

Hello guys, i,m new in Splunk and this is my question:

Example, i have this NetFlow data:

dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=17

dest_port=443 protoid=6
dest_port=443 protoid=17
dest_port=443 protoid=17
dest_port=443 protoid=17

I need output with count like that:

     dest_port        |         protoid          |             count

       1024                       6                               3
       1024                       17                              1
       443                        6                               1
       443                        17                              3

I mean, need count for each key with it's unique value.

Thank you.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

assuming they appear in your _raw data exactly as you have shown them...

| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are separated by anything else or can appear in another order...

| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...

| stats count by dest_port protoid

View solution in original post

Explorer

It was easier that i thought, thank you a lot guys, you are all are right.

0 Karma

SplunkTrust
SplunkTrust

Hi monserta,
... | stats count by dest_port protoidalt text

SplunkTrust
SplunkTrust

upvote for nice demo

0 Karma

Explorer

Thank you

0 Karma

Contributor

Do you mean like this?

your base search | stats count by dest_port, protoid

Explorer

Thank you 😃

0 Karma

SplunkTrust
SplunkTrust

assuming they appear in your _raw data exactly as you have shown them...

| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are separated by anything else or can appear in another order...

| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...

| stats count by dest_port protoid

View solution in original post

Explorer

Thank you)

0 Karma