Splunk Search

How to write a search to display the count when two fields have unique values?

kjamsheed
New Member

Hi,

I would like to create a statistics table where the end result shows the count of product that has gotten the most number of hits. The logic to be used is to extract the product name and IP address from the log and check if they are unique, and if they are, display the count.

ex log :

00.11.11.00 has viewed product abc
00.11.11.00 has viewed product xyz
00.11.22.00 has viewed product abc
00.22.11.00 has viewed product abc
00.11.22.00 has viewed product xyz
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product abc

end result :
abc = 3
xyz = 2

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | rex "(?<actionTime>[\S]+).*?product\s+(?<product>\w+)" | stats dc(actionTime) BY product

View solution in original post

woodcock
Esteemed Legend

Like this:

... | rex "(?<actionTime>[\S]+).*?product\s+(?<product>\w+)" | stats dc(actionTime) BY product

kjamsheed
New Member

Excellent. worked for me.

If you don't mind, can you explain what it actually does? bit new to splunk and still trying the understand various arguments.

0 Karma

woodcock
Esteemed Legend

The rex creates the 2 fields that we require, then we need a statistical analysis across all events returned from the base search ( | stats ) where we count the number of distinct values of the one field ( dc(actionTime) ) rolled-up/aggregated by the other field ( BY product ).

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...