Splunk Search

Multiple stats count

Atif
Explorer

Hi Folks,

My test data are like :

DOC_ID,PROCESS_ID,RECEIVER

DOC_10,PROC_A100,REC_0001

DOC_10,PROC_A100,REC_0002

DOC_20,PROC_A100,REC_0001

DOC_30,PROC_A100,REC_0001

DOC_50,PROC_A200,REC_0001

DOC_60,PROC_A200,REC_0001

 

stats count by PROCESS_ID,RECEIVER  :

PROCESS_ID,RECEIVER,count

PROC_A100,REC_0001,3

PROC_A100,REC_0002,1

PROC_A200,REC_0001,2

 

I would like to append the total of distinct DOC_ID for each PROCESS_ID :

Atif_0-1631892762455.png

TOTAL_OF_DOCS first line is 3, because PROC_A100 has DOC_10+DOC_20+DOC_30

TOTAL_OF_DOCS second line is 2, because PROC_A200 has DOC_50+DOC_60

 

Any hints are welcome.

With kind regards

Labels (2)
0 Karma

ITWhisperer
Legend
| eventstats dc(DOC_ID) as TOTAL_OF_DOCS by PROCESS_ID
| stats values(TOTAL_OF_DOCS) as TOTAL_OF_DOCS count by PROCESS_ID,RECEIVER
| stats values(TOTAL_OF_DOCS) as TOTAL_OF_DOCS list(RECEIVER) as RECEIVER list(count) as count by PROCESS_ID
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!