Splunk Search

How to show the most common non-null value in every field?

seajay1221
Engager

I have an index with ~200 fields and need to know the single most common non-null value for each field. How do I uncover that with Splunk?

In this example, I'd start here:

FruitsSizesIntegers
apple 1
bananalarge10
strawberry 3
apple 3
blueberrylarge2

 

And would aim to end up here:

FruitsSizesIntegers
applelarge3

 

I don't have a test query to share since I'm not sure how to begin approaching this, and haven't seen anything on the forum here that is a close match. Would greatly appreciate any insights into how to get this done!

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

As @richgalloway  use the mode function - if you don't want to list all 200 fields on the stats command, try this

| stats mode(*) as *

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

As @richgalloway  use the mode function - if you don't want to list all 200 fields on the stats command, try this

| stats mode(*) as *

richgalloway
SplunkTrust
SplunkTrust

Try the stats command with the mode function.

| stats mode(Fruits) as Fruits, mode(Sizes) as Sizes, mode(Integers) as Integers

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...