Splunk Search

How to fetch results by grouping the fields with a condition like count>0?

New Member

Hi Team,

I have fields like txn_id and txn_chain_id where txn_chain_id can have more than 1 txn_id like:

Log 1: .....txn_id=100 txn_chain_id=1000
Log 2: .....txn_id=101 txn_chain_id=1000
Log 3: .....txn_id=102 txn_chain_id=1000
Log 4: .....txn_id=201 txn_chain_id=2000
Log 5: .....txn_id=202 txn_chain_id=2000

And so on.

I wish to write a search which gives me output as below, dynamically pulling all the txn_chain_ids having txn_ids > 1.

txn_chain_id              count(txn_id)
1000                           3
2000                           2

Can someone help me getting the search?
Please do the needful.

0 Karma
1 Solution

Revered Legend

Try this

your base search |  stats dc(txt_id) as "count of txn_id" by txn_chain_id

View solution in original post

Revered Legend

Try this

your base search |  stats dc(txt_id) as "count of txn_id" by txn_chain_id

View solution in original post

New Member

Thanks. It worked.

0 Karma

Revered Legend

Great.. Please close the question by clicking on the Accept.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!