Splunk Search

How to get a dc on 2 fields?

mgao
Engager

I have two fields, "sender" and "recipient". I want to create a table that lists distinct sender-recipient pairs and the corresponding # of events for each pair. I can't think of how to use stats dc or dedup to do this. Any ideas?

Tags (2)
0 Karma
1 Solution

pradeepkumarg
Influencer
| stats count by sender recepient  

or

| eval sender_recepient = sender."-".recepient | stats count by sender_recepient  

View solution in original post

somesoni2
Revered Legend

How about this? This should give you "list of distinct sender-recipient pairs and the corresponding # of events for each pair"

YOur current search with field sender and recipient
| stats count by sender recipient

pradeepkumarg
Influencer
| stats count by sender recepient  

or

| eval sender_recepient = sender."-".recepient | stats count by sender_recepient  
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...