Splunk Search

How to calculate the number of different eventtypes in a transaction?

tony_alibelli
New Member

Hi All

this is my data on one transaction

Nov 4 13:55:51 10.236.33.22 Nov 4 13:55:51 LPD-ZF5-001 notice tmm3[19702]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK 
Nov 4 14:51:20 10.236.33.22 Nov 4 14:51:20 LPD-ZF5-001 notice tmm[19699]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK 
Nov 4 14:51:33 10.236.33.22 Nov 4 14:51:33 LPD-ZF5-001 notice tmm2[19701]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK 
Nov 4 15:29:17 10.236.33.22 Nov 4 15:29:17 LPD-ZF5-001 notice tmm3[19702]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK 
Nov 4 15:29:26 10.236.33.22 Nov 4 15:29:26 LPD-ZF5-001 notice tmm[19699]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK 
Nov 4 15:29:33 10.236.33.22 Nov 4 15:29:33 LPD-ZF5-001 notice tmm2[19701]: 01490505:5: decbdf41: RD: Connect to 10.148.2.142 port 2598 err ERR_OK

i defined eventtype who match each line and when i try to calculate the occurrence of the eventtype i have always 1

So how calculate the occurrence of this eventtype ?

Regards

Tony

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

By default the transaction command calculates multivalue fields as distinct values only. You can set mvlist=eventtype though to disable this behaviour for that field.

0 Karma

tony_alibelli
New Member

Hi
i would like calcule the number of each eventtype by this transaction
Regards

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Are you looking for the number of different eventtypes or the event count per eventtype?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...