https://community.splunk.com/t5/Splunk-Search/Confusion-with-count/m-p/472100#M132831 <P>Thank You. It worked</P> Mon, 23 Dec 2019 16:23:29 GMT palisetty 2019-12-23T16:23:29Z https://community.splunk.com/t5/Splunk-Search/Confusion-with-count/m-p/472098#M132829 <P>I have a source with 100,000 events. For an Interesting field "action" where it has value as "purchase" with a count of 21,000. I want to make use of stats command with count function to see the count of events in my event list.<BR /> I tried this but it is not accepting.</P> <P>index="main"<BR /> | stats count(action) =" purchase" as "Total count of Purchase occurences"</P> <P>What is the correct syntax, please?</P> Mon, 23 Dec 2019 16:13:54 GMT https://community.splunk.com/t5/Splunk-Search/Confusion-with-count/m-p/472098#M132829 palisetty 2019-12-23T16:13:54Z https://community.splunk.com/t5/Splunk-Search/Confusion-with-count/m-p/472099#M132830 <P>@palisetty </P> <P>Try this.</P> <PRE><CODE>index="main" | stats count(eval(action="purchase")) as "Total count of Purchase occurences" </CODE></PRE> Mon, 23 Dec 2019 16:19:11 GMT https://community.splunk.com/t5/Splunk-Search/Confusion-with-count/m-p/472099#M132830 kamlesh_vaghela 2019-12-23T16:19:11Z https://community.splunk.com/t5/Splunk-Search/Confusion-with-count/m-p/472100#M132831 <P>Thank You. It worked</P> Mon, 23 Dec 2019 16:23:29 GMT https://community.splunk.com/t5/Splunk-Search/Confusion-with-count/m-p/472100#M132831 palisetty 2019-12-23T16:23:29Z