Splunk Search

How to get a Stats count of field values by country

Hildoceras
New Member

Hi

I am looking at access log data with the fields src_ip and method (get, post, head)

I have been running the search src_ip="*" | iplocation src_ip | stats count by country

this gives me an event count by country.

I would like to take this further and also get a count of total events by country and a split per country of get, post and head

any help appreciated

Tags (1)
0 Karma

MuS
SplunkTrust
SplunkTrust

Hi Hildoceras,

something like this should get you there:

 ... | stats count(eval(method="POST")) AS post count(eval(method="GET")) AS get count(eval(method="HEAD")) AS head by country | addtotals 

hope this helps ...

cheers, MuS

MuS
SplunkTrust
SplunkTrust

feel free to accept the answer, thanks 😉

0 Karma

Hildoceras
New Member

Worked like a charm many thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...