Splunk Search

How to get a dc on 2 fields?

mgao
Engager

I have two fields, "sender" and "recipient". I want to create a table that lists distinct sender-recipient pairs and the corresponding # of events for each pair. I can't think of how to use stats dc or dedup to do this. Any ideas?

Tags (2)
0 Karma
1 Solution

pradeepkumarg
Influencer
| stats count by sender recepient  

or

| eval sender_recepient = sender."-".recepient | stats count by sender_recepient  

View solution in original post

somesoni2
Revered Legend

How about this? This should give you "list of distinct sender-recipient pairs and the corresponding # of events for each pair"

YOur current search with field sender and recipient
| stats count by sender recipient

pradeepkumarg
Influencer
| stats count by sender recepient  

or

| eval sender_recepient = sender."-".recepient | stats count by sender_recepient  
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...