Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to write a search to display the count whe...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I would like to create a statistics table where the end result shows the count of product that has gotten the most number of hits. The logic to be used is to extract the product name and IP address from the log and check if they are unique, and if they are, display the count.
ex log :
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product xyz
00.11.22.00 has viewed product abc
00.22.11.00 has viewed product abc
00.11.22.00 has viewed product xyz
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product abc
end result :
abc = 3
xyz = 2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this:
... | rex "(?<actionTime>[\S]+).*?product\s+(?<product>\w+)" | stats dc(actionTime) BY product
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this:
... | rex "(?<actionTime>[\S]+).*?product\s+(?<product>\w+)" | stats dc(actionTime) BY product
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Excellent. worked for me.
If you don't mind, can you explain what it actually does? bit new to splunk and still trying the understand various arguments.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The rex creates the 2 fields that we require, then we need a statistical analysis across all events returned from the base search ( | stats ) where we count the number of distinct values of the one field ( dc(actionTime) ) rolled-up/aggregated by the other field ( BY product ).
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
