Splunk Search

can we get 4 different fields count per hour

snallam123
Path Finder

I am trying to get count of four fields [ company_name companyID CustomerId Provider] by each hour

index=IndexName 
| bin span=1h _time 
| stats count by company_name companyID CustomerId Provider _time 
| sort 0 _time 
| eval results= 'companyName'+" : "+'companyID'+" : "+'CustomerId'+" : "+'Provider'
| eval time=strftime(_time,"%m-%d-%Y--%H-%M-%S") 
| table results time count 
| xyseries results time count 
| rex field=results "(?<companyName>.+):(?<companyID>.+):(?<CustomerId>.+):(?<Provider>.+)"
| table  company_name companyID CustomerId Provider * 
| addcoltotals labelfield=company_name label="Total_count"
| fields - count results

I am able to get results like i need, But i am pretty sure this search isn't the good way to do it.

Expected results:

company_name companyID CustomerId   Provider 12:00 01:00 02:00 03:00 04:00 ---
  Apple        1234       vgs31982   pro-1     10    20    30    40   10 
  google       567        kjf733     pro-2     11    11    33    83    20
 Total_count                                   21    31    63    123   30

can some help me on this.

0 Karma

to4kawa
Ultra Champion
index=IndexName 
| eval results= 'companyName'+" : "+'companyID'+" : "+'CustomerId'+" : "+'Provider' 
| timechart span=1h count by results
| eval time=strftime(_time,"%H:%M") 
| table results time count 
| xyseries results time count 
| addcoltotals labelfield=results label="Total_count"
| rex field=results "(?<companyName>.+):(?<companyID>.+):(?<CustomerId>.+):(?<Provider>.+)" 
| table company_name companyID CustomerId Provider *
| fields - count results
| fillnull company_name value="Total_count"
0 Karma

snallam123
Path Finder

Actually my query is working fine, I am just looking for a different approach without combining all fields.
I can't accept this answer, I don't see any difference from what my question is..

0 Karma

to4kawa
Ultra Champion

If that is the case, you will need to show us a sample log.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...