Splunk Search

How to calculate count of key per each different values?

monserta
Explorer

Hello guys, i,m new in Splunk and this is my question:

Example, i have this NetFlow data:

dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=17

dest_port=443 protoid=6
dest_port=443 protoid=17
dest_port=443 protoid=17
dest_port=443 protoid=17

I need output with count like that:

     dest_port        |         protoid          |             count

       1024                       6                               3
       1024                       17                              1
       443                        6                               1
       443                        17                              3

I mean, need count for each key with it's unique value.

Thank you.

0 Karma
1 Solution

DalJeanis
Legend

assuming they appear in your _raw data exactly as you have shown them...

| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are separated by anything else or can appear in another order...

| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...

| stats count by dest_port protoid

View solution in original post

monserta
Explorer

It was easier that i thought, thank you a lot guys, you are all are right.

0 Karma

adonio
Ultra Champion

Hi monserta,
... | stats count by dest_port protoidalt text

DalJeanis
Legend

upvote for nice demo

0 Karma

monserta
Explorer

Thank you

0 Karma

adayton20
Contributor

Do you mean like this?

your base search | stats count by dest_port, protoid

monserta
Explorer

Thank you 😃

0 Karma

DalJeanis
Legend

assuming they appear in your _raw data exactly as you have shown them...

| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are separated by anything else or can appear in another order...

| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid

If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...

| stats count by dest_port protoid

monserta
Explorer

Thank you)

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...