Splunk Search

How to create a stats count by aggregating multiple fields?

dkotowsk
Engager

How do you create a stats count after aggregating multiple fields into one?

Example: Given the following table:

index saddr daddr
A 10.0.0.1 192.168.1.8
A 10.0.0.1 192.168.1.9

How can I get a table like the following?

index addr count
A 10.0.0.1 2
A 192.168.1.8 1
A 192.168.1.9 1
0 Karma
1 Solution

traxxasbreaker
Communicator

You can try something like this, though there may be a more efficient way to do it.

<Base Search> | eval addr=saddr+":"+daddr | makemv delim=":" addr | mvexpand addr | stats count by addr

Basically, you combine the source and destination addresses together and make that a multi-valued field, expand out those values so there's an event for each value, then use stats to group by those new values.

View solution in original post

traxxasbreaker
Communicator

You can try something like this, though there may be a more efficient way to do it.

<Base Search> | eval addr=saddr+":"+daddr | makemv delim=":" addr | mvexpand addr | stats count by addr

Basically, you combine the source and destination addresses together and make that a multi-valued field, expand out those values so there's an event for each value, then use stats to group by those new values.

Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcement

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...