A002 : A]
[A004 : 2]
[A005 : 2000]
[A006 : 0110]
[A007 : 85]
[A008 : VISA Credit]
[A008.ID : 9]
[A010 : 1644757200000]
[A019 : ANZ 407220]
[A021 : 20]
[A022 : A]
[RESPONDER : 5]
[A028 : 85]
SELECT A028, responder, count( * ) as total from table
where A028 <> '00' group by auth_resp_cde, auth_responder
The above one is SQL query i wanted to similar query in the SPLNK please assist.
Hi @jayeshrajvir,
I suppose that you already extracted all the fields from your logs and you need only the search to display results grouped by; if not, you have also to extract all used fields.
So, please try something like this:
index=your_index A028!="00"
| stats values(A028) AS A28 values(responder) AS responder count AS total BY auth_resp_cde auth_responder
Ciao.
Giuseppe
Hi @jayeshrajvir,
I suppose that you already extracted all the fields from your logs and you need only the search to display results grouped by; if not, you have also to extract all used fields.
So, please try something like this:
index=your_index A028!="00"
| stats values(A028) AS A28 values(responder) AS responder count AS total BY auth_resp_cde auth_responder
Ciao.
Giuseppe
Thanks for your help. It's working
Hi @jayeshrajvir,
good for you, see next time!
Ciao and happy splunking
Giuseppe
P.S.: Karma Points are appreciated 😉