Splunk Search

how to extract total count for different fields

wkau
New Member

Hi, i will like to extract the count for the following

Data_no: 1T    
Identity: A  
Data_no: 2T  
Identity: C

i tried the following

| rex max_match= 0 "(?m) Data_no: (?<DataNo>[a-zA-Z0-9#]+)"  
| rex max_match= 0 "(?m) Identity: (?<Identity>[a-zA-Z0-9#]+)"   
| stats count(eval(Identity= "A")) as A, count(eval(Identity= "C")) as C by DataNo

The table returns the following:

DataNO| A | C  
1T    | 1 | 1  
2T    | 1 | 1

How to i filter it so that it will become like this:

DataNO| A | C  
1T    | 1 | 0  
2T    | 0 | 1

Thanks for your help!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this

Updated

your base search| rex max_match= 0 "(?m) Data_no: (?<DataNo>[a-zA-Z0-9#]+)"  
| rex max_match= 0 "(?m) Identity: (?<Identity>[a-zA-Z0-9#]+)" | eval temp=mvzip (DataNo, Identity) | mvexpand temp | rex field=temp "(?<DataNo>.*) (?<Identity>.*)"
| chart count over DataNo by Identity
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try updated answer.

0 Karma

wkau
New Member

I still got back the same results the data that is provided happens in the same event at the same time, is it possible to filter the DataNO and Identity individually so that it does not double count?

0 Karma

wkau
New Member

after trying that i got A=1, C=1 for 1T and A=1, C=1 for 2T. i will need something like A=1,C=0 for 1T and A=0, C=1 for 2T

0 Karma

strive
Influencer

try this
|chart count by datano identity

0 Karma

wkau
New Member

yup this is an example of how my data is!

0 Karma

strive
Influencer

Data_no: 1T
Identity: A
Data_no: 2T
Identity: C

This is how your data is? If answer is no then can you post some sample log lines.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...