Splunk Search

How to count stats for two different field logs coming from the same device by using the OR command?

aqudoos
Explorer

I have two different fields in logs coming from the same device. I want to count that stats for both fields by using the OR command but it's not running.

Following is the command:

|stats count by (Source-IP OR source_ip ) 

Source-ip and source_ip are two different fields

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One can't use OR in that context. Use a separate eval to establish the by field. For example,

| eval src_ip = coalesce(Source-IP, source_IP) | stats count by src_ip
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

krishnab
Path Finder

Also you can get by segregating the data only from those two sources

index=* source=a OR source=b
|stats count by source

0 Karma

FrankVl
Ultra Champion

I downvoted this post because he wants to count by source_ip field. splunk's 'source' metadata field has nothing to do with that.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One can't use OR in that context. Use a separate eval to establish the by field. For example,

| eval src_ip = coalesce(Source-IP, source_IP) | stats count by src_ip
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

aqudoos
Explorer

Thanks!!!!

0 Karma

FrankVl
Ultra Champion

Rename one of the fields to match the name of the other, before doing the stats, so for example:

| rename Source-IP AS source_ip
| stats count by source_ip
0 Karma

aqudoos
Explorer

Thanks!!!!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!