Splunk Search

How to write a search to display the count when two fields have unique values?

kjamsheed
New Member

Hi,

I would like to create a statistics table where the end result shows the count of product that has gotten the most number of hits. The logic to be used is to extract the product name and IP address from the log and check if they are unique, and if they are, display the count.

ex log :

00.11.11.00 has viewed product abc
00.11.11.00 has viewed product xyz
00.11.22.00 has viewed product abc
00.22.11.00 has viewed product abc
00.11.22.00 has viewed product xyz
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product abc
00.11.11.00 has viewed product abc

end result :
abc = 3
xyz = 2

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | rex "(?<actionTime>[\S]+).*?product\s+(?<product>\w+)" | stats dc(actionTime) BY product

View solution in original post

woodcock
Esteemed Legend

Like this:

... | rex "(?<actionTime>[\S]+).*?product\s+(?<product>\w+)" | stats dc(actionTime) BY product

kjamsheed
New Member

Excellent. worked for me.

If you don't mind, can you explain what it actually does? bit new to splunk and still trying the understand various arguments.

0 Karma

woodcock
Esteemed Legend

The rex creates the 2 fields that we require, then we need a statistical analysis across all events returned from the base search ( | stats ) where we count the number of distinct values of the one field ( dc(actionTime) ) rolled-up/aggregated by the other field ( BY product ).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...