Splunk Search

combining 2 stats output into 1

p_basanth
New Member

I want to combine the below 2 ouputs into single line

| stats count by Domain

| stats values(Domain) by Short_Host

The expected output is

Short_Host Values(Domain) Count by Domain

Tags (1)
0 Karma

royimad
Builder

You can combine several line with "," and count for a specific values
| stats count(eval(Domain="y")) , count(eval(Domain="x")) by Short_Host

0 Karma

p_basanth
New Member

| stats values(Domain), count by Short_Host gives me overall count. But i need individual count by Domain.

0 Karma

p_basanth
New Member

something similar to values,count group by short_host. For each short_host multiple domains and corresponding count in a table format.

0 Karma

p_basanth
New Member

Apologies. My expectation is as per below:
Short_Host Values(Domain) Count by Domain
host 1 abc 11
xyz 15
def 20
host 2 abc 06
xyz 27
def 34

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Rounding off the Splunk Dashboard Contest

What does a contest-winning Splunk dashboard look like? In this case, it isn't in a browser tab at all. It ...

A Four Part Event Series: AI + Observability: AI Agents, LLMs, Apps, & Infrastructure

AI + Observability: AI Agents, LLMs, Apps, & Infrastructure The rapid evolution of artificial intelligence ...

Splunk Technical Support Is Moving to Cisco Support Tools

Introduction Splunk technical support is transitioning to Cisco’s support environment. This change brings ...