To find the count of specific fields

[Real_captain]

Hi Team 

I want to know if it is possible to find the count of specific fields and show them in different columns.

Example : 

For the above example, i want the result in the below format:

| Date | File RPWARDA | Count of File SPWARAA |  Count of File SPWARAA | Count of File SPWARRA | Diff (RPWARDA   - ( SPWARAA +SPWARRA ) ) |

|2024/04/10 | 49 | 38 | 5 | 6 |

Is it possible using a splunk query ? 

Original query : 

index=events_prod_cdp_penalty_esa source="SYSLOG"
(TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA))
| rex field=TEXT "NIDF=(?<file>[^\\s]+)"
| eval DIR = if(file="RPWARDA" ,"IN","OUT")
| convert timeformat="%Y/%m/%d" ctime(_time) AS Date
| stats count by Date , file , DIR

[PickleRick]

1. I don't see why you calculate the IN/OUT parameter if you don't need this value in the end.

2. Assuming you don't need the DIR field, you can simply use xyseries to... put your values into a x/y table.

| xyseries Date file count

 Now you can just calculate your sum/difference of various files as you have them as separate fields. (you might have to fillnull with zero if you have blank spaces).

[scelikok]

Hi @Real_captain,

You can try below;

index=events_prod_cdp_penalty_esa source="SYSLOG" (TERM(NIDF=RPWARDA) OR TERM(NIDF=SPWARAA) OR TERM(NIDF=SPWARRA))
| rex field=TEXT "NIDF=(?<file>[^\\s]+)"
| convert timeformat="%Y/%m/%d" ctime(_time) AS Date
| stats count(eval(file="RPWARDA")) AS RPWARDA, count(eval(file="SPWARAA")) AS SPWARAA, count(eval(file="SPWARRA")) AS SPWARRA by Date
| eval Diff=(RPWARDA-(SPWARAA+SPWARRA))