Splunk Search

How to compare 5 different fields and get the count of their occurrence

aaa2324
Explorer

Hi Team,

I would like to compare below 5 different columns and get one more column as a count.

category code  text  country  org

abc           100      Adv    US          12

abc            100     Adv    US         12

abc             100     Agh    Eu           13

abc             100     Agh    Eu           13

Column count should have have the number of times of occurrence of the below, say first 2 entries are occurring 2 time so it should display the output as

category code  text  country  org   Count

abc           100      Adv    US          12       2

kindly help with the query to achieve this.

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@aaa2324 

try this.

 

YOUR_SEARCh | stats count by category code  text  country  org

 

Sample:

| makeresults | eval _raw="category	code	text	country	org
abc	100	Adv	US	12
abc	100	Adv	US	12
abc	100	Agh	Eu	13
abc	100	Agh	Eu	13"
| multikv forceheader=1
| table category code  text  country  org
| stats count by category code  text  country  org

 

0 Karma

aaa2324
Explorer

Thanks but this is giving me the results as count below.

abc     100     Adv    US   1

but I want the result to have count as 2 since it is occurring twice. 

kindly advise 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Screenshot 2021-05-04 at 7.10.20 PM.png

 

 It's giving 2 as count. can you please share your sample search ?

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...