https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-on-a-string-and-name-the-string-as-a-column/m-p/501138#M139554 <P>ProxyName=PLB and ("/policies" OR "/bills") stats count by ProxyName</P> <P>I want the string "/policies" or "/bills" to be in a column name TYPE with the counts for each string.</P> Wed, 04 Dec 2019 15:47:29 GMT maddenm2 2019-12-04T15:47:29Z https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-on-a-string-and-name-the-string-as-a-column/m-p/501138#M139554 <P>ProxyName=PLB and ("/policies" OR "/bills") stats count by ProxyName</P> <P>I want the string "/policies" or "/bills" to be in a column name TYPE with the counts for each string.</P> Wed, 04 Dec 2019 15:47:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-on-a-string-and-name-the-string-as-a-column/m-p/501138#M139554 maddenm2 2019-12-04T15:47:29Z https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-on-a-string-and-name-the-string-as-a-column/m-p/501139#M139555 <P>Could you provide event samples that contain both types? Have you considered extracting the field "type". Please provide some more data so we can see what you're working with.</P> Wed, 04 Dec 2019 16:36:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-on-a-string-and-name-the-string-as-a-column/m-p/501139#M139555 oscar84x 2019-12-04T16:36:19Z https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-on-a-string-and-name-the-string-as-a-column/m-p/501140#M139556 <P>Like this (upper-casing of <CODE>AND</CODE> is VERY important):</P> <PRE><CODE>index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND ProxyName="PLB" AND ("/policies" OR "/bills") | eval TYPE = if(searchmatch("/policies"), "policies", "bills") | stats COUNT BY TYPE ProxyName </CODE></PRE> <P>Or better yet, like this:</P> <PRE><CODE>index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND ProxyName="PLB" AND ("/policies" OR "/bills") | eval TYPE = if(searchmatch("/policies"), "policies", "bills") | chart COUNT BY TYPE ProxyName </CODE></PRE> <P>Or even better, like this:</P> <PRE><CODE>index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="AndSourcetypeToo" AND ProxyName="PLB" AND ("/policies" OR "/bills") | stats count AS TOTAL count(eval(searchmatch("/policies"))) AS policies count(eval(searchmatch("/bills"))) AS bills BY ProxyName </CODE></PRE> Wed, 04 Dec 2019 18:14:53 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-stats-on-a-string-and-name-the-string-as-a-column/m-p/501140#M139556 woodcock 2019-12-04T18:14:53Z