Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Aggregate report on a multi-value field

$
0
0

I have a data set like the following:

01/21/2013  /root1/url,/root2/url,/root2/url
02/22/2013  /root1/url,/root3/url

and I would like to generate a report like the following

event    root   count    urls
1        root1  1        /root1/url
1        root2  2        /root2/url
                         /root2/url 
2        root1  1        /root1/url
2        root3  1        /root3/url

Is there a way to get what I want using splunk functions where urls are filterd by root in the same row. I was able to use "makemv" and "streamstats" to get the first 3 fields but not able to filter urls based on root value.


Viewing all articles
Browse latest Browse all 13053

Latest Images

Trending Articles



Latest Images

<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>