Splunk Search

Splunk Condition Search

MM0071
Path Finder

Let's say im running a search where I want to look at domains traveled to.

index=web_traffic sourcetype=domains domain IN ("*.com", "*.org*", "*.edu*")

I want to do a count on how domains that have appeared less than 5 times over the search period. How can I accomplish this? I know I could do a

stats count by domain

but after that, I'm unable to grab the rest of the results in the index such as time, etc.

 

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The stats command is transforming, which means only the fields referenced in it are available to subsequent commands.  In this case, they would be count and domain.  To make other fields available, include them in stats.

| status count, values(*) as * by domain

 Note that fields other than count and domain may be multi-valued and so may require special handling using mv* functions.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The stats command is transforming, which means only the fields referenced in it are available to subsequent commands.  In this case, they would be count and domain.  To make other fields available, include them in stats.

| status count, values(*) as * by domain

 Note that fields other than count and domain may be multi-valued and so may require special handling using mv* functions.

---
If this reply helps you, Karma would be appreciated.

MM0071
Path Finder

Thank you so much for the help. Can you explain to me what the follow line means? 

 

values(*) as *

0 Karma

richgalloway
SplunkTrust
SplunkTrust

values(*) as * means take the values of all other fields and put them into fields by the same name.  So each field that existed before stats will exist after it, but possibly with more than one value in each.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's a way of telling Splunk to rename the fields.

Normally if you just do

| stats values(*)

it will name the resulting fields values(fielda), values(fieldb), values(fieldc) and so on. If you just want to see what those values are that's no problem but that's not very convenient to work with such fields later. So if you do

| stats values(*) as *

The resulting mutivalued fields will be named the same as the original fields which you are summarizing were so instead of values(fielda) you'll still have fielda.

 

0 Karma

MM0071
Path Finder

Gotcha. So how can I implement logic so only show domains that show up 5 or less times?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You have the count field so you can use the where command to filter the events.

MM0071
Path Finder

Is it as simple as: 

| stats count, values(*) as * by domain < 5  

I get an error trying to do 

| where stats count, values(*) as * by domain < 5

0 Karma

PickleRick
SplunkTrust
SplunkTrust

No. Don't try to squeeze everything into one command 🙂

| stats count, values(*) as * by domain

This will give you results groupped by domain.

So now you have to filter the results with another command.

| where count<=5

And you're home.

MM0071
Path Finder

thank you. much appreciated.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...