Splunk Search

Multiple stats count

Atif
Explorer

Hi Folks,

My test data are like :

DOC_ID,PROCESS_ID,RECEIVER

DOC_10,PROC_A100,REC_0001

DOC_10,PROC_A100,REC_0002

DOC_20,PROC_A100,REC_0001

DOC_30,PROC_A100,REC_0001

DOC_50,PROC_A200,REC_0001

DOC_60,PROC_A200,REC_0001

 

stats count by PROCESS_ID,RECEIVER  :

PROCESS_ID,RECEIVER,count

PROC_A100,REC_0001,3

PROC_A100,REC_0002,1

PROC_A200,REC_0001,2

 

I would like to append the total of distinct DOC_ID for each PROCESS_ID :

Atif_0-1631892762455.png

TOTAL_OF_DOCS first line is 3, because PROC_A100 has DOC_10+DOC_20+DOC_30

TOTAL_OF_DOCS second line is 2, because PROC_A200 has DOC_50+DOC_60

 

Any hints are welcome.

With kind regards

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eventstats dc(DOC_ID) as TOTAL_OF_DOCS by PROCESS_ID
| stats values(TOTAL_OF_DOCS) as TOTAL_OF_DOCS count by PROCESS_ID,RECEIVER
| stats values(TOTAL_OF_DOCS) as TOTAL_OF_DOCS list(RECEIVER) as RECEIVER list(count) as count by PROCESS_ID
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...