Splunk Search

How to create a stats count by aggregating multiple fields?

Engager

How do you create a stats count after aggregating multiple fields into one?

Example: Given the following table:

index saddr daddr
A 10.0.0.1 192.168.1.8
A 10.0.0.1 192.168.1.9

How can I get a table like the following?

index addr count
A 10.0.0.1 2
A 192.168.1.8 1
A 192.168.1.9 1
0 Karma
1 Solution

Communicator

You can try something like this, though there may be a more efficient way to do it.

<Base Search> | eval addr=saddr+":"+daddr | makemv delim=":" addr | mvexpand addr | stats count by addr

Basically, you combine the source and destination addresses together and make that a multi-valued field, expand out those values so there's an event for each value, then use stats to group by those new values.

View solution in original post

Communicator

You can try something like this, though there may be a more efficient way to do it.

<Base Search> | eval addr=saddr+":"+daddr | makemv delim=":" addr | mvexpand addr | stats count by addr

Basically, you combine the source and destination addresses together and make that a multi-valued field, expand out those values so there's an event for each value, then use stats to group by those new values.

View solution in original post