Refine your search:

So I'm trying to run a search in Splunk and have two fields combined to return one larger field. My basic search is:

(host="web01.inno-360.com" AND source="/var/log/apache2/basf_ssl_access.log" AND "/profile-services/talent") OR (host="zakta01.inno-360.com" AND basf-landscaping.inno-360.com AND "GET /search" AND query=*)

From that I'm interested in two fields: 1) 'query' 2) 'q'. I would like to combine these two fields to end with something like:

... | stats count by newField

From searching I have tried using eval like this:

... | eval newField= query." ".q | stats count by newField

However I've had absolutely no luck at all with this. Any help with this would be greatly appreciated.

asked 18 May '12, 12:24

henryt1's gravatar image

henryt1
1013312
accept rate: 0%


One Answer:

Your eval statement is fine. You need to fix the stats count. This should do it.

. | eval newField= query." ".q | stats count(newField)

Then you could do | stats count(newField) by newField

link

answered 18 May '12, 13:34

sdaniels's gravatar image

sdaniels ♦
6.0k410
accept rate: 33%

edited 18 May '12, 13:34

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×430
×229
×30

Asked: 18 May '12, 12:24

Seen: 1,693 times

Last updated: 18 May '12, 13:34

Copyright © 2005-2014 Splunk Inc. All rights reserved.