Splunk Search

Total counts of one field based on distinct counts of another field

jawebb
Explorer

This seems like it should be simple, but I'm new to Splunk and can't figure it out. I have one field dc(Name) that corresponds with another field that has multiple values.

For example:

Name: Values:
PC1 Value1, Value2, Value3
PC2 Value1, Value2, Value4
PC3 Value1, Value2

I need to get a count of the total number of distinct "Values" for distinct "Names". So, the sum of 3 values for PC1, 3 for PC2, 2 for PC3 etc...Keep i mind this comes from a daily DB input so the events will duplicate after every import. I looked into a few different commands but they don't seem to be working for this task.

Thanks for any help.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | stats values(Values) AS Values by Name | eval numValues=mvcount(Values)

View solution in original post

woodcock
Esteemed Legend

Like this:

... | stats values(Values) AS Values by Name | eval numValues=mvcount(Values)

jawebb
Explorer

Thanks! That seemed to do the trick.

0 Karma

somesoni2
Revered Legend

Do not forget to close the question by accepting the answer.

0 Karma

somesoni2
Revered Legend

Is the field Values a multivalued field OR it's a single string with multiple values separated by comma? What is your current search?

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...