Splunk Search

How to get a stats count on multiple fields in a table sorted by count?

adicoza786
Explorer

Hi All,

I am trying to get the count of different fields and put them in a single table with sorted count.

stats count(ip) | rename count(ip) as count |
append [stats count(login) | rename count(login) as count] | 
append [ stats count(bcookie) | rename count(bcookie) as count]

I seem to be getting the following output:

count 
10
20
30

However, I need the output to be something like this:

 name        count 
 ip          10
 login       20
 bcookie     30

Thanks in advance.
Aditya

0 Karma
1 Solution

jluo_splunk
Splunk Employee
Splunk Employee

You could simply do..

 stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.

However, the format of the results table is a little different from what you requested.

View solution in original post

manideeplanka
New Member

I have a similar usecase all though a little extra is needed...I need count by bcookie and ip.

Then
stats count(ip) as ip by ip, count(bcookie) as bcookie by bcookie
is not working 😞

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

You could simply do..

 stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.

However, the format of the results table is a little different from what you requested.

adicoza786
Explorer

I need to construct a pie chart based on these counts.

Your above query will give me the following o/p-

ip login bcookie
20 30 50

Is there a way I construct a pie chart out of these with 20% for ip 30% for login and 50% for bcookie

0 Karma

adicoza786
Explorer

I got it. The following gives the result I am expecting

stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie | transpose

jluo_splunk
Splunk Employee
Splunk Employee

Glad you figured it out!

0 Karma

adicoza786
Explorer

Thanks jluo for your help

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...