Splunk Search

How to get count by unique value?

vel4ever
New Member

Hi,

I am new to Splunk. I have below log which is capturing product id,

Header product-id, 12345678900
Header product-id, 12345678901
Header product-id, 12345678900

I would like to group by unique product id and count,

12345678900 2
12345678901 1

Here product-id is not a field in splunk. How can write a query for this?

Tags (1)
0 Karma

manjunathmeti
Champion

Use rex command.

 | rex "product-id,\s(?<product_id>[\d\.]+)" | stats count by product_id
0 Karma

harishalipaka
Motivator

hi @vel4ever

try this

| makeresults 
 | eval raw="Header product-id, 12345678900" 
 |eval ID=mvindex(split(raw," "),-1) |stats count by ID
Thanks
Harish
0 Karma

vel4ever
New Member

I am not getting any results for this query. Thanks.

0 Karma

jpolvino
Builder

If your log is literally lines like Header product-id, 12345678900 then you can extract the last value (assuming all digits) and stats-by on that.

Example:

(your search)
| rex "Header product-id, (<productId>\d+)"
| stats count by productId

If this doesn't work, please post the actual events you get back and I'm sure people here can help!

0 Karma

vel4ever
New Member

I am getting error while running this query. And product-id could be decimal value too, ex: 123.4567.8900. Thanks

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...