Splunk Search
Highlighted

how to get the number of records of a field and sum up and show records more than one

Explorer

Hi everyone. I would like to ask what is the function to get the number of records in a field?

So here's my scenario.

I use the search to get results below using transaction by username

|search *** transaction by username | table server_name, username, ipaddress

alt text

using the above results, i want to count the number of records in the ipaddress field and display the number of records but remove the field where ipaddress is less than 2 records.

I want this kind of output:

alt text

Thanks I hope someone can help me..

0 Karma
Highlighted

Re: how to get the number of records of a field and sum up and show records more than one

Legend

In your case you can use mvcount() function for conting occurrences of multi-valued field.

| eval no_of_multiple_con=mvcount(ipaddress)

However, I would try to move away from transaction to stats command

 <YourBaseSearch> | stats values(server_name) as server_name values(ipaddress) as ipaddress count(ipaddress) as no_of_multiple_con dc(ipaddress) as disctinctIPCount by username

PS: Since you have not included server_name as your transaction ID, I would expect multiple Server Names to be returned as well. Hence I have used values() function.
Also I have included dc() function for distinct count of IP Addresses in case the same gets repeated.

View solution in original post

Highlighted

Re: how to get the number of records of a field and sum up and show records more than one

Explorer

@niketnilay.. thanks a lot.. it works 🙂

0 Karma
Highlighted

Re: how to get the number of records of a field and sum up and show records more than one

Legend

@wiggler... Glad it worked. Hope you are using stats as it would perform better than transaction as you might have seen 🙂

0 Karma
Highlighted

Re: how to get the number of records of a field and sum up and show records more than one

Explorer

@niketnilay yeah much better than transaction. thank you very much

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.