Splunk Search
Highlighted

How to write a search to display the count when two fields have unique values?

New Member

Hi,

I would like to create a statistics table where the end result shows the count of product that has gotten the most number of hits. The logic to be used is to extract the product name and IP address from the log and check if they are unique, and if they are, display the count.

ex log :

00.11.11.00 has viewed product abc
00.11.11.00 has viewed product xyz
00.11.22.00 has viewed product abc
00.22.11.00 has viewed product abc
00.11.22.00 has viewed product xyz
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product abc

end result :
abc = 3
xyz = 2

0 Karma
Highlighted

Re: How to write a search to display the count when two fields have unique values?

Esteemed Legend

Like this:

... | rex "(?<actionTime>[\S]+).*?product\s+(?<product>\w+)" | stats dc(actionTime) BY product

View solution in original post

Highlighted

Re: How to write a search to display the count when two fields have unique values?

New Member

Excellent. worked for me.

If you don't mind, can you explain what it actually does? bit new to splunk and still trying the understand various arguments.

0 Karma
Highlighted

Re: How to write a search to display the count when two fields have unique values?

Esteemed Legend

The rex creates the 2 fields that we require, then we need a statistical analysis across all events returned from the base search ( | stats ) where we count the number of distinct values of the one field ( dc(actionTime) ) rolled-up/aggregated by the other field ( BY product ).

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.