topic Re: How do I get total count of a field per host? in Splunk Search

How do I get total count of a field per host?

amit2312 — Wed, 07 Sep 2022 22:11:03 GMT

Hi,

I am new to splunk, this might have asked and answered but didn't get the answer when i searched it. here is my query: I have a base query, which basically gets the ids field(ex : 1234,3213) from different hosts. i want to get the total number of ids per host.

data:

host : ids: price: details

xyz:123:$45:example

cds:143:$45:example

Re: Get total count of a field per host

richgalloway — Wed, 07 Sep 2022 21:20:42 GMT

Use the stats command for that.

| stats count(ids) by host

Re: How do I get total count of a field per host?

bowesmana — Wed, 07 Sep 2022 23:33:27 GMT

As @richgalloway but if you want unique ids, use dc(ids)

Re: Get total count of a field per host

amit2312 — Fri, 09 Sep 2022 20:41:53 GMT

Thanks a lot for your help. it worked.