Splunk Search

How to search the count of a field's values in a comma delimited list and display it as a table?

heming277
New Member

Hi,

I have a serious problem. I'm trying to get the counts of all the values for a field in a comma delimited list, but seems Splunk only picks up the first value, so I cannot use stats count by Fieldname to show it directly.

Part of the search is this:

&fieldA=a,b,c,d&fieldB=a,b,c,d HTTP/1.1" 200 

How do I get all the counts for a, b, c, d and output the count in a table?

For example:

Field A

a 20
b 22
c 23
d 24

Please suggest a search, thanks.

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (assuming the field names are fixed, e.g. fieldA fieldB etc.)

your base search | rex field=_raw "fieldA=(?<fieldA>[^&\s]+)" | makemv fieldA delim="," | stats count by fieldA

View solution in original post

0 Karma

somesoni2
Revered Legend

Try like this (assuming the field names are fixed, e.g. fieldA fieldB etc.)

your base search | rex field=_raw "fieldA=(?<fieldA>[^&\s]+)" | makemv fieldA delim="," | stats count by fieldA
0 Karma

heming277
New Member

thank you! it seems to work

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...