Splunk Search

combining 2 stats output into 1

p_basanth
New Member

I want to combine the below 2 ouputs into single line

| stats count by Domain

| stats values(Domain) by Short_Host

The expected output is

Short_Host Values(Domain) Count by Domain

Tags (1)
0 Karma

royimad
Builder

You can combine several line with "," and count for a specific values
| stats count(eval(Domain="y")) , count(eval(Domain="x")) by Short_Host

0 Karma

p_basanth
New Member

| stats values(Domain), count by Short_Host gives me overall count. But i need individual count by Domain.

0 Karma

p_basanth
New Member

something similar to values,count group by short_host. For each short_host multiple domains and corresponding count in a table format.

0 Karma

p_basanth
New Member

Apologies. My expectation is as per below:
Short_Host Values(Domain) Count by Domain
host 1 abc 11
xyz 15
def 20
host 2 abc 06
xyz 27
def 34

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...