Splunk Search

How to count stats for two different field logs coming from the same device by using the OR command?

aqudoos
Explorer

I have two different fields in logs coming from the same device. I want to count that stats for both fields by using the OR command but it's not running.

Following is the command:

|stats count by (Source-IP OR source_ip ) 

Source-ip and source_ip are two different fields

Tags (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

One can't use OR in that context. Use a separate eval to establish the by field. For example,

| eval src_ip = coalesce(Source-IP, source_IP) | stats count by src_ip
---
If this reply helps you, Karma would be appreciated.

View solution in original post

krishnab
Path Finder

Also you can get by segregating the data only from those two sources

index=* source=a OR source=b
|stats count by source

0 Karma

FrankVl
Ultra Champion

I downvoted this post because he wants to count by source_ip field. splunk's 'source' metadata field has nothing to do with that.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

One can't use OR in that context. Use a separate eval to establish the by field. For example,

| eval src_ip = coalesce(Source-IP, source_IP) | stats count by src_ip
---
If this reply helps you, Karma would be appreciated.

aqudoos
Explorer

Thanks!!!!

0 Karma

FrankVl
Ultra Champion

Rename one of the fields to match the name of the other, before doing the stats, so for example:

| rename Source-IP AS source_ip
| stats count by source_ip
0 Karma

aqudoos
Explorer

Thanks!!!!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...