Splunk Search

Loop through a particular field counting how many values there are for each value of said field

trc29
Engager

Hello all!

I feel like this is a simple query and I just can't wrap my head around it. The data I'm searching through has a field named "SenderAddress". This is an email address. I want to take each unique email address and count how many instances there are of it.

For example, lets see I have three email address in the source data: test1@gmail.com, myemail@hotmail.com, qwerty@gmail.com.

test1 has sent 10 emails so it appears 10 times
myemail has sent 1 email so it will appear only once
qwerty has sent 3 emails, appearing three times

I want the results to come out as follows:
test1@gmail.com - 10
myemail - 1
qwerty - 3

For the life of me I cannot figure out this syntax. Any help is greatly appreciated!

Tags (1)
0 Karma
1 Solution

maciep
Champion

I think you want to use stats here...

.... | stats count by SenderAddress

In general, getting out of the mindset of manually looping through results will be helpful. Commands like stats, chart, timechart, etc. will handle that for you. Or when piping to a command like eval, Splunk is looping through all of the results and applying the command to each.

You'll feel like you're losing some control if coming from a programming/scripting background, but it's nice to let Splunk do some of that for you.

View solution in original post

trc29
Engager

Works perfectly. I am having a hard time wrapping my head around the way I process data in splunk with some things but I'll get there. I just want to write a for each loop lol.

Thanks again

0 Karma

maciep
Champion

one day it clicked for me, so i'd say hang in there. Now i think of searching data more like a puzzle - i know what i'm starting with, i know what i want to end with, and i know the commands i have to work with...now just figure out how to string the commands together to solve the puzzle.

0 Karma

maciep
Champion

I think you want to use stats here...

.... | stats count by SenderAddress

In general, getting out of the mindset of manually looping through results will be helpful. Commands like stats, chart, timechart, etc. will handle that for you. Or when piping to a command like eval, Splunk is looping through all of the results and applying the command to each.

You'll feel like you're losing some control if coming from a programming/scripting background, but it's nice to let Splunk do some of that for you.

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...