Splunk Search

distinct count

Mike6960
Path Finder

I have events which contain batches. There are several batchtypes. For example Batch; A01,A02,A03.
When a batch is started it is stored for example like this: A01-sample-2019-03-20-mm. I want to count the number of batches per batchtype per moment (2019-03-20)

Now I have this: ....search...... | stats distinct_count(batch) as count by batch| table batch count

Tags (1)
0 Karma
1 Solution

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval msg="A01-sample-2019-03-20-mm,A01-sample-2019-03-20-mm,A01-sample-2019-03-21-mm" 
| makemv delim="," msg 
| mvexpand msg 
| rex field=msg "(?P<batch>^[^-]+)(\-\w+\-)(?P<date>\d{4}-\d{2}-\d{2})" 
| stats count by batch,date

View solution in original post

0 Karma

vnravikumar
Champion

Hi

Give a try

| makeresults 
| eval msg="A01-sample-2019-03-20-mm,A01-sample-2019-03-20-mm,A01-sample-2019-03-21-mm" 
| makemv delim="," msg 
| mvexpand msg 
| rex field=msg "(?P<batch>^[^-]+)(\-\w+\-)(?P<date>\d{4}-\d{2}-\d{2})" 
| stats count by batch,date
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...