Splunk Search

How do I run a stats search to display a count and other fields by another field?

Makinde
New Member

How can I run the stats command to generate a count and display the count and other fields by another field. i.e

How do i get a display like;

Src_ip          dest_port       Count
10.1.34.5           25            3
                    30           67
10.64.34.8         443           34
                    80           25
                    56            9

I already have the search that generates the events with these fields, I just want to generate the display to look this way.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your current search giving single value table with Src_ip dest_port and count | stats list(*) as * by Src_ip

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try something like this

your current search giving single value table with Src_ip dest_port and count | stats list(*) as * by Src_ip

Makinde
New Member

I guess i have to replace * with the fields I want right? How do I fill in the multiple fields because it's reporting an error also.

Using the * alone doesn't return any value.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What is the search that you tried? The above one is assuming that you're already getting result in a table format with only the field Src_ip, dest_port, count. If that's not the case specify every field that you want to list, based on Src_ip.

...| stats list(dest_port) as dest_port list(count) as count by Src_ip
0 Karma

Makinde
New Member

This display in the question didn't come out as well as I wanted it in the question above.

It is a table with columns Src Ip, dest_port and count. There is only one src_IP address for multiple dest_ports and count. I hope this explanation helps to visualize it.

Thanks,

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...