https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-the-number-of-duplicates-that-have-been/m-p/454351#M128552 <P>try this:</P> <P><CODE>index=myIndexVal log_level="'ERROR'" | stats count by reason, desc</CODE> </P> Tue, 14 May 2019 00:11:10 GMT adonio 2019-05-14T00:11:10Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-the-number-of-duplicates-that-have-been/m-p/454350#M128551 <P>There are many failures in my logs and many of them are failing for the same reason. I am using this query to see the unique reasons:</P> <PRE><CODE>index=myIndexVal log_level="'ERROR'" | dedup reason, desc | table reason, desc </CODE></PRE> <P>I also want a count next to each row saying how many duplicates there were for that reason. Basically I want a frequency count of each type of failure. I am a complete beginner and am in no way married to the above command, in fact the count doesn't even have to be in the table generated by the above query, I just need the numbers and the failure types, it doesn't have to be pretty or anything.</P> <P>All the other posts I'm seeing seem to require me to know all the failure reasons, as in there needs to be some limited number that I can put into the query, but thats not feasible in my situation. <BR /> Thank you in advance.</P> Tue, 14 May 2019 00:01:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-the-number-of-duplicates-that-have-been/m-p/454350#M128551 marty1234 2019-05-14T00:01:39Z https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-the-number-of-duplicates-that-have-been/m-p/454351#M128552 <P>try this:</P> <P><CODE>index=myIndexVal log_level="'ERROR'" | stats count by reason, desc</CODE> </P> Tue, 14 May 2019 00:11:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-the-count-of-the-number-of-duplicates-that-have-been/m-p/454351#M128552 adonio 2019-05-14T00:11:10Z