Splunk Search

How to fetch results by grouping the fields with a condition like count>0?

iamsgsn
New Member

Hi Team,

I have fields like txn_id and txn_chain_id where txn_chain_id can have more than 1 txn_id like:

Log 1: .....txn_id=100 txn_chain_id=1000
Log 2: .....txn_id=101 txn_chain_id=1000
Log 3: .....txn_id=102 txn_chain_id=1000
Log 4: .....txn_id=201 txn_chain_id=2000
Log 5: .....txn_id=202 txn_chain_id=2000

And so on.

I wish to write a search which gives me output as below, dynamically pulling all the txn_chain_ids having txn_ids > 1.

txn_chain_id              count(txn_id)
1000                           3
2000                           2

Can someone help me getting the search?
Please do the needful.

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

your base search |  stats dc(txt_id) as "count of txn_id" by txn_chain_id

View solution in original post

somesoni2
Revered Legend

Try this

your base search |  stats dc(txt_id) as "count of txn_id" by txn_chain_id

iamsgsn
New Member

Thanks. It worked.

0 Karma

somesoni2
Revered Legend

Great.. Please close the question by clicking on the Accept.

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...