How to get count by unique value?

[vel4ever]

Hi,

I am new to Splunk. I have below log which is capturing product id,

Header product-id, 12345678900
Header product-id, 12345678901
Header product-id, 12345678900

I would like to group by unique product id and count,

12345678900 2
12345678901 1

Here product-id is not a field in splunk. How can write a query for this?

[manjunathmeti]

Use rex command.

 | rex "product-id,\s(?<product_id>[\d\.]+)" | stats count by product_id

[harishalipaka]

hi @vel4ever

try this

| makeresults 
 | eval raw="Header product-id, 12345678900" 
 |eval ID=mvindex(split(raw," "),-1) |stats count by ID

[vel4ever]

I am not getting any results for this query. Thanks.

[jpolvino]

If your log is literally lines like Header product-id, 12345678900 then you can extract the last value (assuming all digits) and stats-by on that.

Example:

(your search)
| rex "Header product-id, (<productId>\d+)"
| stats count by productId

If this doesn't work, please post the actual events you get back and I'm sure people here can help!

[vel4ever]

I am getting error while running this query. And product-id could be decimal value too, ex: 123.4567.8900. Thanks