Splunk Search

Count number of occurrences of a field in a transaction search

kagouros1
Explorer

Hi,

i am creating a correlation between two different event sources and then run a transaction based on the src ip like so:

index=i1 OR index=i2|transaction src_ip|table src_ip,value_from_index1,value_from_index2

Now I would like to have a column that tells me how many events of index1 and index2 each are in the result.
Something like |eval foo=mvcount(value_from_index1) gives me the number of different events, but I want the total number.

Any help would be appreciated.

Konstantin

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

Are you sure you need to make a transaction? stats can usually do much of the tasks (and faster), along these lines;

index=i1 OR index=i2 | stats c(index1_field) c(index2_field) by src_ip

/K

0 Karma

kristian_kolb
Ultra Champion

or make a timechart

0 Karma

linu1988
Champion

You can use | bucket _time span=5m / bin to group events time wise.

0 Karma

kagouros1
Explorer

OK i forgot to put the 'maxspan=5m' in the search string. That's why I did it as a transaction as I only want to match those that happen in a certain time frame.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...