Splunk Search

Count unique values of a field in one result

valentin_bogdan
Explorer

I have the following result from a simple search:

I, [2015-07-23T15:30:39+02:00 (1437658239.654) #38640]  INFO -- ccceedb1a97f382d192a93fab686319b
[...]
"GET /?sid=ccceedb1a97f382d192a93fab686319b 
[...]
https://[...]?sid=756a0279d436826f3ad51ba00f49d65d" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 (PSBrowserEmbedded) Safari/537.36" [...]

(part of the search result hidden due to confidentiality requirements)

However, it is not a normal behavior of the system for 'sid' to have two different values in one result. So I'm trying to find all results for a certain time frame where there are multiple values (i.e. more than one unique value) of 'sid' in one result. I'm guessing it should be something similar to this:
http://answers.splunk.com/answers/105397/count-unique-values-from-a-text-result.html

But in one result.

How can I do this?

Tags (3)
1 Solution

somesoni2
SplunkTrust
SplunkTrust

If Splunk is already identifying the field 'sid' for you as multivalued field for events having multiple values of it, try this:-

your base search | where mvcount(sid)=2 AND mvindex(sid,0)!=mvindex(sid,1)

If the field sid is not extracted by Splunk automatically, try this

your base search | rex max_match=0 "sid=(?<sid>\w+)" | where mvcount(sid)=2 AND mvindex(sid,0)!=mvindex(sid,1)

View solution in original post

neelamssantosh
Contributor

Hi Valentin,

U can use |transaction command which will group with respect to session ID's..

your base search | rex "(?im)sid=(?\w+)" | transaction sid | stats count by sid

Hope it will help.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If Splunk is already identifying the field 'sid' for you as multivalued field for events having multiple values of it, try this:-

your base search | where mvcount(sid)=2 AND mvindex(sid,0)!=mvindex(sid,1)

If the field sid is not extracted by Splunk automatically, try this

your base search | rex max_match=0 "sid=(?<sid>\w+)" | where mvcount(sid)=2 AND mvindex(sid,0)!=mvindex(sid,1)

valentin_bogdan
Explorer

Thank you somesoni2,

Your answer seems to have worked best for me and returns results as I needed. Apparently, 'sid' is not extracted automatically by Splunk, so I had to use the second suggestion.

Thanks to everyone for looking into this.

0 Karma

krishnarajapant
Path Finder

stats dc(field)

you can extract the field or use can user regualrexpression.

-Krishna Rajapantula

0 Karma

valentin_bogdan
Explorer

Thanks krishnarajapantula,

However, this doesn't seem to work for me. The search brings me no results (having the same time range as the initial search).

I was thinking it might be a bit more complex search, but am open to try any other suggestions.

BR

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...