Splunk Search

stats count

splunk_novice99
Explorer

Hello again splunk experts

This is my current situation:-

job_no                field4
131                      string1 
                              string2

132                      string3
                              string4

|table job_no, field2, field4|dedup, job_no, field2
|stats count dc(field4) AS dc_field4 by job_no
|eval calc=dc_field4 * count

produces:-

job_no                                       field2                                        dc_field4                              calc

1316212
1326212

This all works fine.  The problem is that I also want to include the strings (string1,string2,string3,string4) in my table. 

Like this:-

job_no                                                                   field4                                                               field2       dc_field4     calc

131string1, string26212
132string3, string46212

 

Any help would be greatly appreciated,

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Tell the stats command you want the values of field4.

|fields job_no, field2, field4
|dedup job_no, field2
|stats count, dc(field4) AS dc_field4, values(field4) as field4 by job_no
|eval calc=dc_field4 * count

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Tell the stats command you want the values of field4.

|fields job_no, field2, field4
|dedup job_no, field2
|stats count, dc(field4) AS dc_field4, values(field4) as field4 by job_no
|eval calc=dc_field4 * count

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

splunk_novice99
Explorer

Perfect!  exactly what I was after.  

Many thanks.

Tags (1)
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...