How to create a stats count by aggregating multiple fields?

[dkotowsk]

How do you create a stats count after aggregating multiple fields into one?

Example: Given the following table:

index	saddr	daddr
A	10.0.0.1	192.168.1.8
A	10.0.0.1	192.168.1.9

How can I get a table like the following?

index	addr	count
A	10.0.0.1	2
A	192.168.1.8	1
A	192.168.1.9	1

[traxxasbreaker · Accepted solution]

You can try something like this, though there may be a more efficient way to do it.

<Base Search> | eval addr=saddr+":"+daddr | makemv delim=":" addr | mvexpand addr | stats count by addr

Basically, you combine the source and destination addresses together and make that a multi-valued field, expand out those values so there's an event for each value, then use stats to group by those new values.