https://community.splunk.com/t5/Splunk-Enterprise-Security/Stats-and-Count-log-after-query/m-p/383269#M3935 <P>Thanks @renjith.nair . Its working.</P> Fri, 12 Jul 2019 04:32:32 GMT tanglong 2019-07-12T04:32:32Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Stats-and-Count-log-after-query/m-p/383267#M3933 <P>Hello,</P> <P>I have problem with stats after query searching on splunk.</P> <P>Please see detail on image.</P> <UL> <LI>Data Log: this is raw index in splunk.</LI> <LI>Show after Query: need query for show result this table.</LI> </UL> <P><span class="lia-inline-image-display-wrapper"><img src="https://community.splunk.com/t5/image/serverpage/image-id/7311i4C096BC40A60E111/image-size/large?v=v2&amp;px=999" title="alt text" alt="alt text" /></span></P> Wed, 10 Jul 2019 08:11:42 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Stats-and-Count-log-after-query/m-p/383267#M3933 tanglong 2019-07-10T08:11:42Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Stats-and-Count-log-after-query/m-p/383268#M3934 <P>@tanglong,</P> <P>Try</P> <PRE><CODE>"your base search"|stats dc(src_ip) as count,values(src_ip) as src_ip by user|sort -count </CODE></PRE> Wed, 10 Jul 2019 13:09:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Stats-and-Count-log-after-query/m-p/383268#M3934 renjith_nair 2019-07-10T13:09:28Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Stats-and-Count-log-after-query/m-p/383269#M3935 <P>Thanks @renjith.nair . Its working.</P> Fri, 12 Jul 2019 04:32:32 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Stats-and-Count-log-after-query/m-p/383269#M3935 tanglong 2019-07-12T04:32:32Z