Splunk Search

How to count stats for two different field logs coming from the same device by using the OR command?

aqudoos
Explorer

I have two different fields in logs coming from the same device. I want to count that stats for both fields by using the OR command but it's not running.

Following is the command:

|stats count by (Source-IP OR source_ip ) 

Source-ip and source_ip are two different fields

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One can't use OR in that context. Use a separate eval to establish the by field. For example,

| eval src_ip = coalesce(Source-IP, source_IP) | stats count by src_ip
---
If this reply helps you, Karma would be appreciated.

View solution in original post

krishnab
Path Finder

Also you can get by segregating the data only from those two sources

index=* source=a OR source=b
|stats count by source

0 Karma

FrankVl
Ultra Champion

I downvoted this post because he wants to count by source_ip field. splunk's 'source' metadata field has nothing to do with that.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One can't use OR in that context. Use a separate eval to establish the by field. For example,

| eval src_ip = coalesce(Source-IP, source_IP) | stats count by src_ip
---
If this reply helps you, Karma would be appreciated.

aqudoos
Explorer

Thanks!!!!

0 Karma

FrankVl
Ultra Champion

Rename one of the fields to match the name of the other, before doing the stats, so for example:

| rename Source-IP AS source_ip
| stats count by source_ip
0 Karma

aqudoos
Explorer

Thanks!!!!

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...