Splunk Search

how to get the number of records of a field and sum up and show records more than one

wiggler
Explorer

Hi everyone. I would like to ask what is the function to get the number of records in a field?

So here's my scenario.

I use the search to get results below using transaction by username

|search *** transaction by username | table server_name, username, ipaddress

alt text

using the above results, i want to count the number of records in the ipaddress field and display the number of records but remove the field where ipaddress is less than 2 records.

I want this kind of output:

alt text

Thanks I hope someone can help me..

0 Karma
1 Solution

niketn
Legend

In your case you can use mvcount() function for conting occurrences of multi-valued field.

| eval no_of_multiple_con=mvcount(ipaddress)

However, I would try to move away from transaction to stats command

 <YourBaseSearch> | stats values(server_name) as server_name values(ipaddress) as ipaddress count(ipaddress) as no_of_multiple_con dc(ipaddress) as disctinctIPCount by username

PS: Since you have not included server_name as your transaction ID, I would expect multiple Server Names to be returned as well. Hence I have used values() function.
Also I have included dc() function for distinct count of IP Addresses in case the same gets repeated.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

In your case you can use mvcount() function for conting occurrences of multi-valued field.

| eval no_of_multiple_con=mvcount(ipaddress)

However, I would try to move away from transaction to stats command

 <YourBaseSearch> | stats values(server_name) as server_name values(ipaddress) as ipaddress count(ipaddress) as no_of_multiple_con dc(ipaddress) as disctinctIPCount by username

PS: Since you have not included server_name as your transaction ID, I would expect multiple Server Names to be returned as well. Hence I have used values() function.
Also I have included dc() function for distinct count of IP Addresses in case the same gets repeated.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

wiggler
Explorer

@niketnilay.. thanks a lot.. it works 🙂

0 Karma

niketn
Legend

@wiggler... Glad it worked. Hope you are using stats as it would perform better than transaction as you might have seen 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

wiggler
Explorer

@niketnilay yeah much better than transaction. thank you very much

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...