Splunk Search

How to group two field and count content?

b1211ry
Explorer

Hi, I have table below

table.jpg

then I need to grouping field and need to eval (+ )the value become below table

Goal.jpg

Help please..🙏

Labels (1)
0 Karma
1 Solution

VatsalJagani
SplunkTrust
SplunkTrust

@b1211ry - You can try adding the below lines at the bottom of your search:

| appendpipe [| rename Application as Common_ProcessName, count_application as count_process]
| stats sum(count_process) as count_process by Common_ProcessName

 

Here my test example query:

| makeresults 
| eval Common_ProcessName="Excel", count_process=1, Application="Outlook", count_application=2
| append [| makeresults | eval Common_ProcessName="Outlook", count_process=1]
| fields - _time
| appendpipe [| rename Application as Common_ProcessName, count_application as count_process]
| stats sum(count_process) as count_process by Common_ProcessName

VatsalJagani_0-1671203844985.png

 

Consider accepting/upvoting answer if this helps!!!

View solution in original post

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@b1211ry - You can try adding the below lines at the bottom of your search:

| appendpipe [| rename Application as Common_ProcessName, count_application as count_process]
| stats sum(count_process) as count_process by Common_ProcessName

 

Here my test example query:

| makeresults 
| eval Common_ProcessName="Excel", count_process=1, Application="Outlook", count_application=2
| append [| makeresults | eval Common_ProcessName="Outlook", count_process=1]
| fields - _time
| appendpipe [| rename Application as Common_ProcessName, count_application as count_process]
| stats sum(count_process) as count_process by Common_ProcessName

VatsalJagani_0-1671203844985.png

 

Consider accepting/upvoting answer if this helps!!!

0 Karma

b1211ry
Explorer

Many Thanks @VatsalJagani!! Problem solved..

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It might be easier to go back a step - how did you create the table in the first place?

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...