Splunk Search

How to group by the to= values, so I can count the number of times they repeat, create charts, and other metrics?

Stephcg
Explorer

Hello!
I have many events, and I have a search that returns only the events that contain the to field.

 

 

index="my_index_qa"    sourcetype="example-qa" to=*

 

 

 

The results are a list of events that have the following pattern:

 

 

	
db271cf8678c -2023-01-12 15:08:32.157 [app=app-name, traceId=traceid-value, spanId=spanid-value,  INFO 1 [llEventLoop-5-5] filter.FilterBeingUsed   : c=class, m=method, method=GET, to=http://example.url.com/path/extra, route=https://example.url.com/redirect/route, headers={X-Forwarded-For=[IPADDRESS, IPADDRESS2], X-Forwarded-Proto=[http], X-Forwarded-Port=[80], Host=[EXAMPLE-HOST], app-device=[DEVICE-INFO], app-user=[devicce-info-os-info], app-os=[APP-OS-VERSION], user-agent=[user-agent-example], app-version=[app.version.example], Origin=[origin-app]}

 

 

 

I want to be able to group by the to= values, so I can count the number of times they repeat, create charts and do some other metrics.

Is it possible? How can I do this?

Thank you for any help in advance. And sorry if I wrote anything wrong, english is not my main language.

 

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

 

index="my_index_qa"    sourcetype="example-qa" to=*
| stats count by to

 

Any time you want to count something, use stats (or eventstats or streamstats or timechart) count.  Grouping by a field implies the by option.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

Stephcg
Explorer

That helped! Thank you a lot! 😊

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Have you tried this?

 

index="my_index_qa"    sourcetype="example-qa" to=*
| stats count by to

 

Any time you want to count something, use stats (or eventstats or streamstats or timechart) count.  Grouping by a field implies the by option.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...