Splunk Search

Splunk search to group by the field values

New Member


I need to assign the values of a field to a new field and group with the new field.

For ex. 

Field-1  Field2

AppA     xxxx

AppA    yyyy

AppA    zzzz

AppB    xxxx

AppB     yyyy

I want to be able to have a stats count with a new field or value for everything that is there with a combination of Field1 and Field2.  i.e in the above result the new search field 3 may be should return 3 and 2 for each apps. 

I was told this might be achieve-able through lookup definitions and tables , but I am new to it. 

Any help will be great. 


Labels (5)
0 Karma

| stats dc(field2) as field3 by field1
0 Karma
Get Updates on the Splunk Community!

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...