Splunk Search

Loop through a particular field counting how many values there are for each value of said field

trc29
Engager

Hello all!

I feel like this is a simple query and I just can't wrap my head around it. The data I'm searching through has a field named "SenderAddress". This is an email address. I want to take each unique email address and count how many instances there are of it.

For example, lets see I have three email address in the source data: test1@gmail.com, myemail@hotmail.com, qwerty@gmail.com.

test1 has sent 10 emails so it appears 10 times
myemail has sent 1 email so it will appear only once
qwerty has sent 3 emails, appearing three times

I want the results to come out as follows:
test1@gmail.com - 10
myemail - 1
qwerty - 3

For the life of me I cannot figure out this syntax. Any help is greatly appreciated!

Tags (1)
0 Karma
1 Solution

maciep
Champion

I think you want to use stats here...

.... | stats count by SenderAddress

In general, getting out of the mindset of manually looping through results will be helpful. Commands like stats, chart, timechart, etc. will handle that for you. Or when piping to a command like eval, Splunk is looping through all of the results and applying the command to each.

You'll feel like you're losing some control if coming from a programming/scripting background, but it's nice to let Splunk do some of that for you.

View solution in original post

trc29
Engager

Works perfectly. I am having a hard time wrapping my head around the way I process data in splunk with some things but I'll get there. I just want to write a for each loop lol.

Thanks again

0 Karma

maciep
Champion

one day it clicked for me, so i'd say hang in there. Now i think of searching data more like a puzzle - i know what i'm starting with, i know what i want to end with, and i know the commands i have to work with...now just figure out how to string the commands together to solve the puzzle.

0 Karma

maciep
Champion

I think you want to use stats here...

.... | stats count by SenderAddress

In general, getting out of the mindset of manually looping through results will be helpful. Commands like stats, chart, timechart, etc. will handle that for you. Or when piping to a command like eval, Splunk is looping through all of the results and applying the command to each.

You'll feel like you're losing some control if coming from a programming/scripting background, but it's nice to let Splunk do some of that for you.

Get Updates on the Splunk Community!

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...