https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-the-number-to-only-show-if-it-sees-an/m-p/636506#M221051 <P>To not search events from all account you could use a csv file as a base for your search filter. The subsearch will output the result of&nbsp;accounts.csv in the form ((account="account_1") OR (account="account_2") etc )</P><P>&nbsp;</P><LI-CODE lang="markup">index=my_index_with_account_data [| inputlookup accounts.csv | table account | format] | table _time, account, * </LI-CODE><P>&nbsp;</P><P>/Seb&nbsp;</P> Wed, 29 Mar 2023 10:47:58 GMT srauhala_splunk 2023-03-29T10:47:58Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-the-number-to-only-show-if-it-sees-an/m-p/636326#M220992 <P>Hello all, im looking to create a dashboard for certain accounts. I have a list of 20 accounts that need to be monitored if they are logging in or not. I did a stats count and can see all the accounts however putting this into a single value visualization shows a count for all the logs so its showing as millions as its counting each log for the accounts.&nbsp;</P> <P>Is there a way to get the number to only show if it sees an account rather than account and every log associated with it, I should only have a max of 20.</P> <P>Thank you</P> Tue, 28 Mar 2023 16:18:35 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-the-number-to-only-show-if-it-sees-an/m-p/636326#M220992 supersnedz 2023-03-28T16:18:35Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-the-number-to-only-show-if-it-sees-an/m-p/636353#M221003 <LI-CODE lang="markup">| stats count by account | stats count</LI-CODE> Tue, 28 Mar 2023 15:54:39 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-the-number-to-only-show-if-it-sees-an/m-p/636353#M221003 ITWhisperer 2023-03-28T15:54:39Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-the-number-to-only-show-if-it-sees-an/m-p/636506#M221051 <P>To not search events from all account you could use a csv file as a base for your search filter. The subsearch will output the result of&nbsp;accounts.csv in the form ((account="account_1") OR (account="account_2") etc )</P><P>&nbsp;</P><LI-CODE lang="markup">index=my_index_with_account_data [| inputlookup accounts.csv | table account | format] | table _time, account, * </LI-CODE><P>&nbsp;</P><P>/Seb&nbsp;</P> Wed, 29 Mar 2023 10:47:58 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-the-number-to-only-show-if-it-sees-an/m-p/636506#M221051 srauhala_splunk 2023-03-29T10:47:58Z https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-the-number-to-only-show-if-it-sees-an/m-p/641562#M222248 <P>Thank you for this! works perfectly&nbsp;</P> Thu, 27 Apr 2023 10:15:38 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-way-to-get-the-number-to-only-show-if-it-sees-an/m-p/641562#M222248 supersnedz 2023-04-27T10:15:38Z