topic Query on stats values in Splunk Search

Query on stats values

p_basanth — Thu, 21 Mar 2013 07:45:57 GMT

| stats values(Domain), count by Short_Host gives me overall count. But i need individual count of each Domain.

| stats count by values(Domain) does not provide any results.

I am expecting the below output

Host1 --> Domain1 --> 5

--> Domain2 --> 8

--> Domain3 --> 1

Host2 --> Domain1 --> 9

--> Domain2 --> 3

--> Domain3 --> 7

Ayn — Thu, 21 Mar 2013 07:50:24 GMT

The by-clause expects field names, nothing else. You should take the Splunk tutorial if you haven't already, it covers things like this.

... | stats count by Short_Host,Domain

p_basanth — Thu, 21 Mar 2013 08:08:11 GMT

is it not possible to get count for each values(Domain)

Ayn — Thu, 21 Mar 2013 09:48:00 GMT

? That's exactly what you get. If you want it split up not by Short_Host AND Domain, just split by Domain.