Hello Community
I'm new with splunk and I need your help.
I have for example the following output (events):
COL_A COL_B COL_ID
row1 row1 1
row2 row2 2
row3 row3 1
row4 row4 3
row5 row5 1
row6 row6 2
What I want, is to add a new field to count them by the occurrence of their ID (col_id):
COL_A COL_B COL_ID occurred
row1 row1 1 3
row2 row2 2 2
row3 row3 1 3
row4 row4 3 1
row5 row5 1 3
row6 row6 2 2
Is there a way to do this?
Br,
Arber
Like this:
| makeresults | eval raw="row1 row1 1::row2 row2 2::row3 row3 1::row4 row4 3::row5 row5 1::row6 row6 2"
| makemv delim="::" raw
| mvexpand raw
| fields - _time
| rex field=raw "^(?<COL_A>\S+)\s+(?<COL_B>\S+)\s+(?<COL_ID>\S+)$"
| rename COMMENT AS "Everything above fakes your data; everything below is your solution"
| eventstats count AS occurred BY COL_ID