Hello guys, i,m new in Splunk and this is my question:
Example, i have this NetFlow data:
dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=6
dest_port=1024 protoid=17
dest_port=443 protoid=6
dest_port=443 protoid=17
dest_port=443 protoid=17
dest_port=443 protoid=17
I need output with count like that:
dest_port | protoid | count
1024 6 3
1024 17 1
443 6 1
443 17 3
I mean, need count for each key with it's unique value.
Thank you.
assuming they appear in your _raw data exactly as you have shown them...
| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid
If they are separated by anything else or can appear in another order...
| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid
If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...
| stats count by dest_port protoid
It was easier that i thought, thank you a lot guys, you are all are right.
upvote for nice demo
Thank you
Do you mean like this?
your base search | stats count by dest_port, protoid
Thank you 😃
assuming they appear in your _raw data exactly as you have shown them...
| rex "dest_port=(?<dest_port>\d+) protoid=(?<protoid>\d+)"
| stats count by dest_port protoid
If they are separated by anything else or can appear in another order...
| rex "dest_port=(?<dest_port>\d+)"
| rex "protoid=(?<protoid>\d+)"
| stats count by dest_port protoid
If they are extracted at index time or automatically at search time and don't actually appear with "field=" notation in your _raw data...
| stats count by dest_port protoid
Thank you)