counting combination of fields

[a212830]

Hi,

How would I count a combination of fields in splunk? For example, I have a "from_ip_addr" and a "to_ip_addr" in an event, and I want to count unique combinations of those two.

[somesoni2 · Accepted solution]

Try this

your base search | stats count by from_op_addr, to_ip_addr | stats count

[a212830]

Great. Thanks!

[sssignals]

It works for me! Thanks.

[martin_mueller]

Leave the final stats off the first suggestion to get this:

your base search | stats count by from_op_addr, to_ip_addr

[a212830]

Thanks. Is there a way to get the combo's listed as well?

from_ip to_ip count

[martin_mueller]

Or this:

your base search | eval from_to = from_ip_addr.to_ip_addr | stats dc(from_to)