<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to group and count together the rows based on some field value in splunk? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-group-and-count-together-the-rows-based-on-some-field/m-p/420556#M120862</link>
    <description>&lt;P&gt;Like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| stats values(custID) count(custID) dc(custID) BY eventID
&lt;/CODE&gt;&lt;/PRE&gt;</description>
    <pubDate>Thu, 05 Jul 2018 04:58:21 GMT</pubDate>
    <dc:creator>woodcock</dc:creator>
    <dc:date>2018-07-05T04:58:21Z</dc:date>
    <item>
      <title>How to group and count together the rows based on some field value in splunk?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-group-and-count-together-the-rows-based-on-some-field/m-p/420555#M120861</link>
      <description>&lt;P&gt;Example:&lt;BR /&gt;
I am having a search in my view code and displaying results in the form of table.&lt;BR /&gt;
small example result:&lt;BR /&gt;
custid Eventid&lt;BR /&gt;
10001 200&lt;BR /&gt;
10001 300&lt;BR /&gt;
10002 200&lt;BR /&gt;
10002 100&lt;BR /&gt;
10002 300&lt;/P&gt;

&lt;P&gt;I got the answer for grouping of the custid's by using the query "stats values(custID) by eventID".  I also need to count the custID that has occurred for every Customer.  Can anyone suggest me the query for the same?  Whatever I use apart from the above query to count the number of custid's I could not get the answers for the same.&lt;/P&gt;</description>
      <pubDate>Thu, 05 Jul 2018 04:28:39 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-group-and-count-together-the-rows-based-on-some-field/m-p/420555#M120861</guid>
      <dc:creator>gokikrishnan198</dc:creator>
      <dc:date>2018-07-05T04:28:39Z</dc:date>
    </item>
    <item>
      <title>Re: How to group and count together the rows based on some field value in splunk?</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-group-and-count-together-the-rows-based-on-some-field/m-p/420556#M120862</link>
      <description>&lt;P&gt;Like this:&lt;/P&gt;

&lt;PRE&gt;&lt;CODE&gt;| stats values(custID) count(custID) dc(custID) BY eventID
&lt;/CODE&gt;&lt;/PRE&gt;</description>
      <pubDate>Thu, 05 Jul 2018 04:58:21 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-group-and-count-together-the-rows-based-on-some-field/m-p/420556#M120862</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2018-07-05T04:58:21Z</dc:date>
    </item>
  </channel>
</rss>

