Splunk Search

combining 2 stats output into 1

p_basanth
New Member

I want to combine the below 2 ouputs into single line

| stats count by Domain

| stats values(Domain) by Short_Host

The expected output is

Short_Host Values(Domain) Count by Domain

Tags (1)
0 Karma

royimad
Builder

You can combine several line with "," and count for a specific values
| stats count(eval(Domain="y")) , count(eval(Domain="x")) by Short_Host

0 Karma

p_basanth
New Member

| stats values(Domain), count by Short_Host gives me overall count. But i need individual count by Domain.

0 Karma

p_basanth
New Member

something similar to values,count group by short_host. For each short_host multiple domains and corresponding count in a table format.

0 Karma

p_basanth
New Member

Apologies. My expectation is as per below:
Short_Host Values(Domain) Count by Domain
host 1 abc 11
xyz 15
def 20
host 2 abc 06
xyz 27
def 34

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

AI has fundamentally raised the stakes for security operations, and this three-part series is your guide to ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...