Splunk Search

How to do eval and stats on fields with many values

Path Finder

Let's say I have logs that look like: date,USER=Joe,ACTION=Open,RESULT=Success

If there are four different types of actions and I want to count the total number of actions by user, I would write a search like:

sourcetype=test.log | stats count(eval(ACTION="Open")) AS Open, count(eval(ACTION="Close")) AS Close, count(eval(ACTION="Read")) AS Read, count(eval(ACTION="Write")) AS Write by DATE,USER | table DATE,USER,Read,Write,Open,Close

What if there are 50 different values for ACTION? Would I have to write a monsterous search string to catch them all or is it possible to count each unique ACTION and save the count in a field with the same name as the action?



Tags (1)
0 Karma


All stats command supports splitting up stats by values like this using the by operator:

sourcetype=test.log | stats count by ACTION

Splunk Employee
Splunk Employee

I this particular case, they want ... | stats count by DATE,USER,ACTION. chart is also an option, but would require some eval to combine and split DATE and USER

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!