- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to search the count of a field with multip...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I'm new to Splunk, so please bear with me. I'm trying to get a count of a field with multiple values by day. As an example, the field is Product_Name. Product_Name can have values such as "iPhone", "iPad", "MacBook" and so on. The number of values is in the hundreds (possibly thousands). I'd like a count of Product_Name by day (for the last 30 days) that I can then export to Excel. The following seemed to get me the closest:
Product_Name="*" | timechart count by Product_Name
This doesn't group the results by day (I tried bucket _time span=1d, but it didn't seem to work). It also doesn't include the full list of values (only about a dozen) and the export option is not available.
The following provides the full list with count, but is not by day:
Product_Name="*" | top limit=10000 Product_Name
Thanks very much for the help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You were really close.
Product_Name="*" | timechart span=1d count by Product_Name
If you have more than 10 product names, after those 10 it'll roll the rest up in an "OTHER" column which you might not want. To remove that "OTHER" column you want this.
Product_Name="*" | timechart span=1d count by Product_Name limit=100
Which technically doesn't remove the possibility of OTHER, it just raises the threshold from 10 to 100.
If you can make the time, it may be worth spending some time with the search manual
http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Whatsinthismanual
or if it's more your style, the Search Tutorial. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchTutorial/WelcometotheSearchTutorial
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi jjc42,
If i understand your problem, try with this:
Product_Name="*"| timechart span=1d count by Product_Name |mvexpand Product_Name
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for your reply. I gave it a try, but I'm not quite sure what "mvexpand" is supposed to do. The results look similar to what I had originally.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You were really close.
Product_Name="*" | timechart span=1d count by Product_Name
If you have more than 10 product names, after those 10 it'll roll the rest up in an "OTHER" column which you might not want. To remove that "OTHER" column you want this.
Product_Name="*" | timechart span=1d count by Product_Name limit=100
Which technically doesn't remove the possibility of OTHER, it just raises the threshold from 10 to 100.
If you can make the time, it may be worth spending some time with the search manual
http://docs.splunk.com/Documentation/Splunk/6.2.2/Search/Whatsinthismanual
or if it's more your style, the Search Tutorial. http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchTutorial/WelcometotheSearchTutorial
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That works. Thanks! And thanks for the links. I'll take a look.
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
