https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491476#M137196 <P>Try this:</P> <PRE><CODE>index = ... | regular expression to catch error max_match=0 | stats count BY error | lookup lookupfile_name error OUTPUT error_description comments | search comments="medium" | stats sum(count) AS count BY error_description </CODE></PRE> Sun, 29 Mar 2020 16:03:05 GMT woodcock 2020-03-29T16:03:05Z https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491472#M137192 <P>I have a difficulty in calculating statistics when different (multiple) values are present for a field in the same event.<BR /> My query now extract the error field (for which i have written the regular expression) and looks for the error and calculate count.<BR /> How to overcome this..<BR /> Please help!</P> Thu, 12 Mar 2020 16:53:23 GMT https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491472#M137192 prettysunshinez 2020-03-12T16:53:23Z https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491473#M137193 <P>You need to output one comment for each errors so expand <STRONG>error</STRONG> values before running <STRONG>lookup</STRONG>. </P> <PRE><CODE>Index = | regular expression to catch error max_match=0 | mvexpand error | lookup lookupfile_name error outputs error_description comments | search comments="$comment$" | stats count by error_description </CODE></PRE> Thu, 12 Mar 2020 20:12:35 GMT https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491473#M137193 manjunathmeti 2020-03-12T20:12:35Z https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491474#M137194 <P>Thank You @manjunathmeti <BR /> It worked <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>I also have another question which is a kind of enhancement to the above query..</P> <P>In the lookup under Comments column I only have 3 catergories (For say : High,Medium,Low)<BR /> And now based on the output of the above query (my initial question), if the error5 which is Low and when its count exceeds a certain limit (say 200) ,its Comment has to be changed as Medium.<BR /> I'm have no clue as to how to start with it..<BR /> Could you kindly help..</P> Sun, 29 Mar 2020 13:35:02 GMT https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491474#M137194 prettysunshinez 2020-03-29T13:35:02Z https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491475#M137195 <P>This is what it <EM>should</EM> do; what would you prefer that it do?</P> Sun, 29 Mar 2020 15:57:42 GMT https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491475#M137195 woodcock 2020-03-29T15:57:42Z https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491476#M137196 <P>Try this:</P> <PRE><CODE>index = ... | regular expression to catch error max_match=0 | stats count BY error | lookup lookupfile_name error OUTPUT error_description comments | search comments="medium" | stats sum(count) AS count BY error_description </CODE></PRE> Sun, 29 Mar 2020 16:03:05 GMT https://community.splunk.com/t5/Splunk-Search/Question-on-calculating-statistics-for-a-field-with-different/m-p/491476#M137196 woodcock 2020-03-29T16:03:05Z