Splunk Search

Grouping and counting by two different fields

larariro
Explorer

Hi everyone,

I'm not sure if I have chosen the title correctly, but I have tried to make it as generic as possible, as it may be useful in other situations.

I want to know how many unique IPs (c_ip) have accessed in the last day a IIS web server grouped by result (sc_status) (error or success).

I can get the number of unique IPs:

sourcetype=iis earliest=-1d@d latest=@d | stats dc(c_ip) by sc_status

Result:

sc_status  dc(c_ip)
200             4285
401                 29
404                 33

I can also get the number of requests summed up by result:

sourcetype=iis earliest=-1d@d latest=@d | bin span=1d _time | stats count as request by _time, sc_status

And get this:

_time                                 sc_status      request
2015-08-30 00:00:00                 200      101335
2015-08-30 00:00:00                 401              31
2015-08-30 00:00:00                 404          1034

What I would like is to group both results, but I don't know how. Just this:

_time                                 sc_status      request   Unique IPs
2015-08-30 00:00:00                 200      101335            4285
2015-08-30 00:00:00                 401              31                29
2015-08-30 00:00:00                 404          1034                33

Is the title right? 🙂

Thanks in advance!

Tags (3)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You are almost there already. try this

sourcetype=iis earliest=-1d@d latest=@d | bin span=1d _time | stats count as request dc(c_ip) as "Unique IPs" by _time, sc_status

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You are almost there already. try this

sourcetype=iis earliest=-1d@d latest=@d | bin span=1d _time | stats count as request dc(c_ip) as "Unique IPs" by _time, sc_status
0 Karma

larariro
Explorer

Awsome, somesoni2. It couldn't have been easier 🙂 I was breaking my head trying to find the way to join both groupings, adding semicolons, pipes, not commas beacause I saw tht was used to separate fields, changing the order,... anything, but I never thought of the simplest solution: just join them with a space. I guess I'll have to find myself a guide for basic searches in Splunk 🙂

Thank you very much for the answer, somesoni2.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...