topic Re: how to display stats results by values(field) in Splunk Search

how to display stats results by values(field)

pkharbanda1021 — Tue, 07 Dec 2021 02:39:43 GMT

I am using the following query and trying to display the results using stats but count by field values

search query |
| table A B C D E
| stats count values(A) as errors values(B) values(C) by E

Also tried
| stats count by E A B C [but this messes up everything as this requires every field to have values]
Current Output
E count A. B C

Value1. 10. X YY ZZZ
Y ZZ BBB

Output
E count A. B C

Value1. 8. X YY ZZZ
2 Y ZZ BBB

@somesoni2

Re: how to display stats results by values(field)

ITWhisperer — Tue, 07 Dec 2021 07:53:03 GMT

search query | | table A B C D E | fillnull value="N/A" A B C | stats count by E A B C

Re: how to display stats results by values(field)

pkharbanda1021 — Tue, 07 Dec 2021 14:29:56 GMT

this doesn't solve my problem

Re: how to display stats results by values(field)

ITWhisperer — Tue, 07 Dec 2021 14:59:06 GMT

Please explain what is not working for you with this method

Re: how to display stats results by values(field)

pkharbanda1021 — Tue, 07 Dec 2021 15:14:40 GMT

results which I am getting arent accurate and its not making any sense
I want the count for each value you see in the first value and with the above solution this is not accurate and doesnt work

Re: how to display stats results by values(field)

ITWhisperer — Tue, 07 Dec 2021 15:19:43 GMT

Can you share the search you used to get these results?

Re: how to display stats results by values(field)

pkharbanda1021 — Tue, 07 Dec 2021 18:17:10 GMT

for now
"your base search" | fillnull value=NA errors
| stats count values(traceid_id) as TraceId by title errors

but I also tried with [this gives me completely different results and I want results by title]
"your base search" | fillnull value=NA errors traceid_id
| stats count by title errors traceid_id

Re: how to display stats results by values(field)

ITWhisperer — Tue, 07 Dec 2021 18:51:05 GMT

It is usually easier when you describe your issue with closer to reality examples. Try something like this

"your base search" | fillnull value=NA errors traceid_id | stats count by title errors traceid_id | stats list(count) as count list(errors) as errors list(traceid_id) as traceid_id by title