Splunk Search

How to compare 5 different fields and get the count of their occurrence

aaa2324
Explorer

Hi Team,

I would like to compare below 5 different columns and get one more column as a count.

category code  text  country  org

abc           100      Adv    US          12

abc            100     Adv    US         12

abc             100     Agh    Eu           13

abc             100     Agh    Eu           13

Column count should have have the number of times of occurrence of the below, say first 2 entries are occurring 2 time so it should display the output as

category code  text  country  org   Count

abc           100      Adv    US          12       2

kindly help with the query to achieve this.

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@aaa2324 

try this.

 

YOUR_SEARCh | stats count by category code  text  country  org

 

Sample:

| makeresults | eval _raw="category	code	text	country	org
abc	100	Adv	US	12
abc	100	Adv	US	12
abc	100	Agh	Eu	13
abc	100	Agh	Eu	13"
| multikv forceheader=1
| table category code  text  country  org
| stats count by category code  text  country  org

 

0 Karma

aaa2324
Explorer

Thanks but this is giving me the results as count below.

abc     100     Adv    US   1

but I want the result to have count as 2 since it is occurring twice. 

kindly advise 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Screenshot 2021-05-04 at 7.10.20 PM.png

 

 It's giving 2 as count. can you please share your sample search ?

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security(ES) 7.3 is approaching the end of support. Get ready for ...

Hi friends!    At Splunk, your product success is our top priority. With Enterprise Security (ES), we're here ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk, and empower your SOC to reach new heights! Duration: 1 hour  Prepare to ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...