Splunk Search

How to edit my inputlookup search to find the count of unique values of FieldA per FieldB?

HattrickNZ
Motivator

I have the following search

| inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_NAME) as TG_NAMES dc(TG_NAMES) by CATEGORY

this gives a single field value in CATEGORY and multiple field values in TG_NAMES per CATEGORY.

*Now I want to be able to count the unique number of field values in the TG_NAMES per CATEGORY, how do i do this? *

I have treid using something like dc(TG_NAMES) but this is just giving me 0 fir each CATEGORY

Tags (3)
0 Karma

jmheaton
Path Finder

Try this

|inputlookup msckpr_test_trunkgroups95_lookup_define | stats values(TG_Name) as Values by CATEGORY | stats dc(Values) by CATEGORY

0 Karma

HattrickNZ
Motivator

nope does not work. dc(Values) are all 0

0 Karma

HattrickNZ
Motivator

this works | inputlookup msckpr_test_trunkgroups95_lookup_define | stats count(TG_NAME) as TG_NAMES by CATEGORY but i loose the TG_NAMES values

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...