Splunk Search

How to get a stats count on multiple fields in a table sorted by count?

adicoza786
Explorer

Hi All,

I am trying to get the count of different fields and put them in a single table with sorted count.

stats count(ip) | rename count(ip) as count |
append [stats count(login) | rename count(login) as count] | 
append [ stats count(bcookie) | rename count(bcookie) as count]

I seem to be getting the following output:

count 
10
20
30

However, I need the output to be something like this:

 name        count 
 ip          10
 login       20
 bcookie     30

Thanks in advance.
Aditya

0 Karma
1 Solution

jluo_splunk
Splunk Employee
Splunk Employee

You could simply do..

 stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.

However, the format of the results table is a little different from what you requested.

View solution in original post

manideeplanka
New Member

I have a similar usecase all though a little extra is needed...I need count by bcookie and ip.

Then
stats count(ip) as ip by ip, count(bcookie) as bcookie by bcookie
is not working 😞

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

You could simply do..

 stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.

However, the format of the results table is a little different from what you requested.

adicoza786
Explorer

I need to construct a pie chart based on these counts.

Your above query will give me the following o/p-

ip login bcookie
20 30 50

Is there a way I construct a pie chart out of these with 20% for ip 30% for login and 50% for bcookie

0 Karma

adicoza786
Explorer

I got it. The following gives the result I am expecting

stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie | transpose

jluo_splunk
Splunk Employee
Splunk Employee

Glad you figured it out!

0 Karma

adicoza786
Explorer

Thanks jluo for your help

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...