Loop through a particular field counting how many values there are for each value of said field

[trc29]

Hello all!

I feel like this is a simple query and I just can't wrap my head around it. The data I'm searching through has a field named "SenderAddress". This is an email address. I want to take each unique email address and count how many instances there are of it.

For example, lets see I have three email address in the source data: test1@gmail.com, myemail@hotmail.com, qwerty@gmail.com.

test1 has sent 10 emails so it appears 10 times
myemail has sent 1 email so it will appear only once
qwerty has sent 3 emails, appearing three times

I want the results to come out as follows:
test1@gmail.com - 10
myemail - 1
qwerty - 3

For the life of me I cannot figure out this syntax. Any help is greatly appreciated!

[trc29]

Works perfectly. I am having a hard time wrapping my head around the way I process data in splunk with some things but I'll get there. I just want to write a for each loop lol.

Thanks again

[maciep]

one day it clicked for me, so i'd say hang in there. Now i think of searching data more like a puzzle - i know what i'm starting with, i know what i want to end with, and i know the commands i have to work with...now just figure out how to string the commands together to solve the puzzle.

[maciep · Accepted solution]

I think you want to use stats here...

.... | stats count by SenderAddress

In general, getting out of the mindset of manually looping through results will be helpful. Commands like stats, chart, timechart, etc. will handle that for you. Or when piping to a command like eval, Splunk is looping through all of the results and applying the command to each.

You'll feel like you're losing some control if coming from a programming/scripting background, but it's nice to let Splunk do some of that for you.