https://community.splunk.com/t5/Splunk-Search/How-can-I-count-lines/m-p/84934#M21658 <PRE><CODE>... |stats sum(linecount) AS MyTotalLines | ... </CODE></PRE> <P>/kristian</P> Wed, 27 Jun 2012 09:26:19 GMT kristian_kolb 2012-06-27T09:26:19Z https://community.splunk.com/t5/Splunk-Search/How-can-I-count-lines/m-p/84931#M21655 <P>hello,</P> <P>This is my search:</P> <PRE><CODE>source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19 PURCH_MIN&gt;44 | stats count by ID_CARDHOLDER| sort - count | where count&gt;=5|rangemap field=count severe=10-50 elevated=3-9 default=low </CODE></PRE> <P>My problem is that I don't able to count the number of lines that my search returns. I want to apply my rangemap on the number of lines but I don't know how I can do it because I try count(_raw) but I don't use it correctly I think.</P> <P>Thx by advance,</P> <P>Laura</P> Wed, 27 Jun 2012 08:30:00 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-count-lines/m-p/84931#M21655 LauraBre 2012-06-27T08:30:00Z https://community.splunk.com/t5/Splunk-Search/How-can-I-count-lines/m-p/84932#M21656 <P>Number of lines in what? Individual raw events? Have you checked the <CODE>linecount</CODE> property?</P> Wed, 27 Jun 2012 08:42:40 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-count-lines/m-p/84932#M21656 Ayn 2012-06-27T08:42:40Z https://community.splunk.com/t5/Splunk-Search/How-can-I-count-lines/m-p/84933#M21657 <P>No, I want to count the total lines that my search returns, not indivduals raw events.</P> Wed, 27 Jun 2012 09:04:37 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-count-lines/m-p/84933#M21657 LauraBre 2012-06-27T09:04:37Z https://community.splunk.com/t5/Splunk-Search/How-can-I-count-lines/m-p/84934#M21658 <PRE><CODE>... |stats sum(linecount) AS MyTotalLines | ... </CODE></PRE> <P>/kristian</P> Wed, 27 Jun 2012 09:26:19 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-count-lines/m-p/84934#M21658 kristian_kolb 2012-06-27T09:26:19Z