Splunk Search

Combining values across multiple fields in an event

jstockamp
Communicator

I've got a bunch of similar fields in my events. I've got fields named term0-9 and I'd like to create a chart that shows the top terms across all those fields.

For example, if I have an event where term0="First+Term" and term1="Second+Term"

Event #    term0    term1     term2
-------    -----    -----     -----
1          Bob      Mary      John
2          Mary     Jake      Tim
3          Bill     Tom       Sally
4          Sam      Sally     Mary

I'd like to output a chart that shows:

Term           Searches
----           --------
Mary           3
Sally          2
Bob            1
John           1
Jake           1
Tim            1
Bill           1
Tom            1
etc .......

Is this possible. If I just combine the fields into one and group based on that, then the order of the search term becomes significant and I don't want it to be.

Anyone have any ideas?

mkashif
Explorer

Hello,

you can achieve your objective using top command and count by command

0 Karma

jstockamp
Communicator

Care to give a little more details on your suggestion? How do I do this across multiple fields?

I can do

top 20 term0

but I don't know how to have it evaluate multiple fields. Thoughts?

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...