Splunk Search

How to group by multiple fields?

rsahoo
Engager

I have a data set from where I am trying to apply the group by function on multiple columns. I tried stats with list and ended up with this output.

country state time #travel
India Bangalore
20220326023652
1
   
20220326023652
1
   
20220327023321
1
   
20220327023321
1
   
20220327023321
1

Whereas I am looking for something below ...

country state time #travel
India Bangalore
20220326023652
2
   
20220327023321
3

 

Any suggestions on the right query please!

Labels (1)
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Without a verbal description of the actual requirement, this is my speculation of the intention: country and state are uniquely determined by time, and #travel is added up.

| stats values(country) as country values(state) as state sum("#travel") as "#travel" by time
Get Updates on the Splunk Community!

Customer Experience | Splunk 2024: New Onboarding Resources

In 2023, we were routinely reminded that the digital world is ever-evolving and susceptible to new ...

Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...