Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to write a search to display the count when tw...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I would like to create a statistics table where the end result shows the count of product that has gotten the most number of hits. The logic to be used is to extract the product name and IP address from the log and check if they are unique, and if they are, display the count.
ex log :
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product xyz
00.11.22.00 has viewed product abc
00.22.11.00 has viewed product abc
00.11.22.00 has viewed product xyz
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product abc
end result :
abc = 3
xyz = 2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this:
... | rex "(?<actionTime>[\S]+).*?product\s+(?<product>\w+)" | stats dc(actionTime) BY product
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this:
... | rex "(?<actionTime>[\S]+).*?product\s+(?<product>\w+)" | stats dc(actionTime) BY product
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Excellent. worked for me.
If you don't mind, can you explain what it actually does? bit new to splunk and still trying the understand various arguments.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The rex creates the 2 fields that we require, then we need a statistical analysis across all events returned from the base search ( | stats ) where we count the number of distinct values of the one field ( dc(actionTime) ) rolled-up/aggregated by the other field ( BY product ).
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
