Splunk Search

How to compare 5 different fields and get the count of their occurrence

aaa2324
Explorer

Hi Team,

I would like to compare below 5 different columns and get one more column as a count.

category code  text  country  org

abc           100      Adv    US          12

abc            100     Adv    US         12

abc             100     Agh    Eu           13

abc             100     Agh    Eu           13

Column count should have have the number of times of occurrence of the below, say first 2 entries are occurring 2 time so it should display the output as

category code  text  country  org   Count

abc           100      Adv    US          12       2

kindly help with the query to achieve this.

Labels (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@aaa2324 

try this.

 

YOUR_SEARCh | stats count by category code  text  country  org

 

Sample:

| makeresults | eval _raw="category	code	text	country	org
abc	100	Adv	US	12
abc	100	Adv	US	12
abc	100	Agh	Eu	13
abc	100	Agh	Eu	13"
| multikv forceheader=1
| table category code  text  country  org
| stats count by category code  text  country  org

 

0 Karma

aaa2324
Explorer

Thanks but this is giving me the results as count below.

abc     100     Adv    US   1

but I want the result to have count as 2 since it is occurring twice. 

kindly advise 

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Screenshot 2021-05-04 at 7.10.20 PM.png

 

 It's giving 2 as count. can you please share your sample search ?

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...