- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Is it possible to perform stats within a trans...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a transaction with multiple values for the same field. Is it possible for me to do a dc(other_field) within a transaction?
My search | transaction same_field maxspan=1m | stats dc(other_field)
Above doesn't seem to work, it just throws away my transactions.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think mvcount() could be your friend here. Something along these lines:
your search | transaction same_field maxspan=1m | eval same_field_count=mvcount(same_field)
...something like that. same_field_count should be a count of the distinct values of same_field within each transaction. If you want a total count of ALL values of same_field (including duplicates) within each transaction, use the mvlist option within your transaction. I'm not where I can test this search but I think it will be pretty close to what you need.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I think mvcount() could be your friend here. Something along these lines:
your search | transaction same_field maxspan=1m | eval same_field_count=mvcount(same_field)
...something like that. same_field_count should be a count of the distinct values of same_field within each transaction. If you want a total count of ALL values of same_field (including duplicates) within each transaction, use the mvlist option within your transaction. I'm not where I can test this search but I think it will be pretty close to what you need.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I dont believe mvcount returns a count of the distinct values. It simply returns a count of the number of values
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure, happy to help!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes! Thank you!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
eventstats perhaps?
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
