topic Re: How to get stats based on multiple values for a single source? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385425#M112558 <P>Thank you Adonio. It worked.</P> Mon, 06 Aug 2018 17:40:42 GMT Nidheesh 2018-08-06T17:40:42Z How to get stats based on multiple values for a single source? https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385420#M112553 <P>I have 3 sources <EM>source1</EM>, <EM>source2</EM>, <EM>source3</EM> and 5 sourcetypes <EM>sourcetype1</EM>, <EM>sourcetype2</EM>, <EM>sourcetype3</EM>, <EM>sourcetype4</EM>, <EM>sourcetype5</EM> for a single host <EM>host1</EM>.</P> <P>Where <EM>sourcetype1</EM> belongs exclusively to <EM>source1</EM> and <EM>sourcetype2</EM> to <EM>source2</EM> but <EM>source3</EM> has 3 sourcetypes; <EM>sourcetype3</EM>, <EM>sourcetype4</EM> and <EM>sourcetype5</EM>. </P> <P>Likewise, I have 2 sources <EM>source4</EM>, <EM>source5</EM> and 3 sourcetypes <EM>sourcetype6</EM>, <EM>sourcetype7</EM>, <EM>sourcetype8</EM> for another host <EM>host2</EM>. With <EM>source4</EM> having <EM>sourcetype6</EM> and <EM>source5</EM> having <EM>sourcetype7</EM> and <EM>sourcetype8</EM>.</P> <P>I wish to have a stats count like this:</P> <PRE><CODE> --------------------------------------- host source sourcetype --------------------------------------- host1 source1 sourcetype1 host1 source2 sourcetype2 host1 source3 sourcetype3 host1 source3 sourcetype4 host1 source3 sourcetype5 host2 source4 sourcetype6 host2 source5 sourcetype7 host2 source5 sourcetype8 </CODE></PRE> <P>Can someone please help?</P> Mon, 06 Aug 2018 13:25:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385420#M112553 Nidheesh 2018-08-06T13:25:00Z Re: How to get stats based on multiple values for a single source? https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385421#M112554 <P>maybe try this:</P> <P><CODE>.... | stats values(sourcetype) as v_sourcetype by source host</CODE></P> Mon, 06 Aug 2018 13:44:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385421#M112554 adonio 2018-08-06T13:44:26Z Re: How to get stats based on multiple values for a single source? https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385422#M112555 <P>try below if you want count:</P> <PRE><CODE>...|stats count by sourcetype </CODE></PRE> <P>and if you want all values as well then try:</P> <PRE><CODE>...|stats values(*) as * count by sourcetype </CODE></PRE> Mon, 06 Aug 2018 13:45:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385422#M112555 493669 2018-08-06T13:45:29Z Re: How to get stats based on multiple values for a single source? https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385423#M112556 <P>It shouldn't be that simple but what's missing from</P> <PRE><CODE>"your search"|stats count by host,source,sourcetype </CODE></PRE> Mon, 06 Aug 2018 14:16:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385423#M112556 renjith_nair 2018-08-06T14:16:03Z Re: How to get stats based on multiple values for a single source? https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385424#M112557 <P>It is that simple. Or, at least, that meets the request the OP wrote up.</P> Mon, 06 Aug 2018 17:28:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385424#M112557 DalJeanis 2018-08-06T17:28:40Z Re: How to get stats based on multiple values for a single source? https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385425#M112558 <P>Thank you Adonio. It worked.</P> Mon, 06 Aug 2018 17:40:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385425#M112558 Nidheesh 2018-08-06T17:40:42Z Re: How to get stats based on multiple values for a single source? https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385426#M112559 <P>Thank you <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 06 Aug 2018 17:41:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-based-on-multiple-values-for-a-single-source/m-p/385426#M112559 Nidheesh 2018-08-06T17:41:20Z