×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
taichii
New Member
Member since: ‎08-15-2020
‎08-16-2020
Community Statistics
Posts 1
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎08-15-2020
View All

Re: How can I count a field grouped by fields from...

by in Splunk Search
‎08-15-2020 04:30 PM
‎08-15-2020 04:30 PM
sample: | makeresults | eval _raw="Shift_id Employee_ID Date 1 994163 8/15/2020 2 123456 8/15/2020 3 654321 8/15/2020 1 994163 8/16/2020 2 123456 8/16/2020 3 654321 8/16/2020 1 991234 8/16/2020" | multikv forceheader=1 | append [| makeresults | eval _raw="Location_id Employee_ID Date L01 994163 8/15/2020 L02 123456 8/15/2020 L03 654321 8/15/2020 L01 994163 8/16/2020 L02 123456 8/16/2020 L03 654321 8/16/2020 L07 991234 8/16/2020" |multikv forceheader=1 ] | fields - _* linecount | selfjoin Date Employee_ID | eventstats count by Date Employee_ID try selfjoin and eventstats ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎08-16-2020 08:31 AM