https://community.splunk.com/t5/Splunk-Search/Count-all-events-matching-field-value/m-p/626689#M217821 <LI-CODE lang="markup">your search and your rex... | stats count by status</LI-CODE> Wed, 11 Jan 2023 02:28:26 GMT bowesmana 2023-01-11T02:28:26Z https://community.splunk.com/t5/Splunk-Search/Count-all-events-matching-field-value/m-p/626688#M217820 <P>My data looks something like this</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="sjs_0-1673402480170.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23301iE9B1EA6B3A0BF7E5/image-size/medium?v=v2&amp;px=400" role="button" title="sjs_0-1673402480170.png" alt="sjs_0-1673402480170.png" /></span></P> <P>The status can be either SUCCESS or FAILED, I want to count the total number of events that has status as FAILED and status as SUCCESS.</P> <P>&nbsp;</P> <P>FYI: The status is not a direct field, I had to extract it out by using&nbsp;</P> <P>| rex "status=(?&lt;Status&gt;[^,]+)"</P> <P>&nbsp;</P> Wed, 11 Jan 2023 18:05:42 GMT https://community.splunk.com/t5/Splunk-Search/Count-all-events-matching-field-value/m-p/626688#M217820 sjs 2023-01-11T18:05:42Z https://community.splunk.com/t5/Splunk-Search/Count-all-events-matching-field-value/m-p/626689#M217821 <LI-CODE lang="markup">your search and your rex... | stats count by status</LI-CODE> Wed, 11 Jan 2023 02:28:26 GMT https://community.splunk.com/t5/Splunk-Search/Count-all-events-matching-field-value/m-p/626689#M217821 bowesmana 2023-01-11T02:28:26Z https://community.splunk.com/t5/Splunk-Search/Count-all-events-matching-field-value/m-p/626690#M217822 <P>Thanks it helped 🥳🥳🥳</P> Wed, 11 Jan 2023 02:40:24 GMT https://community.splunk.com/t5/Splunk-Search/Count-all-events-matching-field-value/m-p/626690#M217822 sjs 2023-01-11T02:40:24Z