topic Re: How to get field count rather than stats count? in Splunk Search

How to get field count rather than stats count?

summitsplunk — Thu, 09 May 2019 20:36:36 GMT

Here's my query:

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats count by devtype

What I want to do is get something like this :

devtype

iphone 100
windows 105
Android 200

I don't want stats on all of the events. I just want the totals of of all the possibilities for the devtype Field. How would I write this?

Re: How to get field count rather than stats count?

Vijeta — Thu, 09 May 2019 21:23:54 GMT

@summitsplunk Can you be more clear, looking at the desired output you have shared your query looks correct , do you have some sample data with output example?

Re: How to get field count rather than stats count?

summitsplunk — Thu, 09 May 2019 21:28:03 GMT

Figured it out. So I just didn't know how to ask the question but with some googling I found the write term which is "Distinct Count"... Basically I wanted to get a distinct count of each field. Like seen in this article:

https://answers.splunk.com/answers/46241/how-can-i-retrieve-count-or-distinct-count-of-some-field-values-using-stats-function.html

Re: How to get field count rather than stats count?

PowerPacked — Thu, 09 May 2019 23:05:32 GMT

Are you looking for this

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats count(devtype) as count

& if you are looking for distinct count - index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
but this only gives the unique values & count of devtype field which is not you are looking for i guess.

Thanks

Re: How to get field count rather than stats count?

summitsplunk — Wed, 30 Sep 2020 00:29:17 GMT

Yeah what you said "index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
but this only gives the unique values & count of devtype field" is exactly right. So I was asking the question sort of wrong.

ultimately my query ended up looking like this to give me my desired output:
index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(src_mac) by devtype

which give me a count of src_mac and groups them by devtype

Re: How to get field count rather than stats count?

woodcock — Sat, 11 May 2019 05:09:24 GMT

Like this:

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)