How to use SPLUNK GROUPBY in my search?

[jayeshrajvir]

A002 : A]
[A004 : 2]
[A005 : 2000]
[A006 : 0110]
[A007 : 85]
[A008 : VISA Credit]
[A008.ID : 9]
[A010 : 1644757200000]
[A019 : ANZ 407220]
[A021 : 20]
[A022 : A]

[RESPONDER : 5]

[A028 : 85]

SELECT A028, responder, count( * ) as total from table
where A028 <> '00' group by auth_resp_cde, auth_responder

The above one is SQL query i wanted to similar query in the SPLNK please assist. 

[gcusello · Accepted solution]

Hi @jayeshrajvir,

I suppose that you already extracted all the fields from your logs and you need only the search to display results grouped by; if not, you have also to extract all used fields.

So, please try something like this:

index=your_index A028!="00"
| stats values(A028) AS A28 values(responder) AS responder count AS total BY auth_resp_cde auth_responder

Ciao.

Giuseppe

[jayeshrajvir]

Thanks for your help. It's working

[gcusello]

Hi @jayeshrajvir,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉