topic Re: Adding fields in stats command in Splunk Search

Adding fields in stats command

smanojkumar — Fri, 06 Oct 2023 08:54:27 GMT

Hi Splunkers!
Good day!
I would like to add event and detection fields in stats command, after adding in stats command, I'm not getting the expected results. I need that fields as well but I should get the expected results,

Old command
| stats count as num by name country state scope

Modified command
| stats count as num by name country state scope event description - giving me wrong results.

Thanks in Advance!
Manoj Kumar S

Re: Adding fields in stats command

gcusello — Fri, 06 Oct 2023 08:59:37 GMT

Hi @smanojkumar,

after the BY cluse you should add only the fields to use for aggregation.

The other fields can be added to the stats command suing the values option.

So if you want to aggregate only for name and you want the other fields, you could use:

| stats count AS num values(country) AS country values(state) AS state values(scope) AS scope values(event) AS event values(description) AS description BY name

As you can read at https://docs.splunk.com/Documentation/SCS/current/SearchReference/StatsCommandOverview

Ciao.

Giuseppe

Re: Adding fields in stats command

smanojkumar — Fri, 06 Oct 2023 10:07:35 GMT

Hi @gcusello ,
It works, Thanks for your response!