Hi,
How would I count a combination of fields in splunk? For example, I have a "from_ip_addr" and a "to_ip_addr" in an event, and I want to count unique combinations of those two.
Try this
your base search | stats count by from_op_addr, to_ip_addr | stats count
Try this
your base search | stats count by from_op_addr, to_ip_addr | stats count
Great. Thanks!
It works for me! Thanks.
Leave the final stats
off the first suggestion to get this:
your base search | stats count by from_op_addr, to_ip_addr
Thanks. Is there a way to get the combo's listed as well?
from_ip to_ip count
Or this:
your base search | eval from_to = from_ip_addr.to_ip_addr | stats dc(from_to)