topic Re: stats count in Splunk Search https://community.splunk.com/t5/Splunk-Search/stats-count/m-p/666266#M228564 <P>Perfect!&nbsp; exactly what I was after.&nbsp;&nbsp;</P><P>Many thanks.</P> Thu, 26 Oct 2023 00:35:19 GMT splunk_novice99 2023-10-26T00:35:19Z stats count https://community.splunk.com/t5/Splunk-Search/stats-count/m-p/666261#M228561 <P>Hello again splunk experts</P><P>This is my current situation:-</P><P><U>job_no&nbsp;</U> &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; <U>field4</U><BR />131&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; string1&nbsp;<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; string2</P><P>132&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; string3<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; string4<BR /><BR />|table job_no, field2, field4|dedup, job_no, field2<BR />|stats count dc(field4) AS dc_field4 by job_no<BR />|eval calc=dc_field4 * count</P><P>produces:-</P><P>job_no&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;field2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; dc_field4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; calc</P><TABLE><TBODY><TR><TD width="42px" height="24px">131</TD><TD width="40px" height="24px">6</TD><TD width="40px" height="24px">2</TD><TD width="40px" height="24px">12</TD></TR><TR><TD width="42px" height="24px">132</TD><TD width="40px" height="24px">6</TD><TD width="40px" height="24px">2</TD><TD width="40px" height="24px">12</TD></TR></TBODY></TABLE><P>This all works fine.&nbsp; The problem is that I also want to include the strings (string1,string2,string3,string4) in my table.&nbsp;</P><P>Like this:-</P><P>job_no&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;field4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;field2&nbsp; &nbsp; &nbsp; &nbsp;dc_field4&nbsp; &nbsp; &nbsp;calc</P><TABLE width="750"><TBODY><TR><TD width="160px" height="24px">131</TD><TD width="160px">string1, string2</TD><TD width="40px" height="24px">6</TD><TD width="40px" height="24px">2</TD><TD width="40px" height="24px">12</TD></TR><TR><TD width="160px" height="24px">132</TD><TD width="160px">string3, string4</TD><TD width="40px" height="24px">6</TD><TD width="40px" height="24px">2</TD><TD width="40px" height="24px">12</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Any help would be greatly appreciated,</P> Wed, 25 Oct 2023 22:58:54 GMT https://community.splunk.com/t5/Splunk-Search/stats-count/m-p/666261#M228561 splunk_novice99 2023-10-25T22:58:54Z Re: stats count https://community.splunk.com/t5/Splunk-Search/stats-count/m-p/666264#M228563 <P>Tell the <FONT face="courier new,courier">stats</FONT> command you want the values of field4.</P><LI-CODE lang="markup">|fields job_no, field2, field4 |dedup job_no, field2 |stats count, dc(field4) AS dc_field4, values(field4) as field4 by job_no |eval calc=dc_field4 * count </LI-CODE><P>&nbsp;</P> Thu, 26 Oct 2023 00:12:02 GMT https://community.splunk.com/t5/Splunk-Search/stats-count/m-p/666264#M228563 richgalloway 2023-10-26T00:12:02Z Re: stats count https://community.splunk.com/t5/Splunk-Search/stats-count/m-p/666266#M228564 <P>Perfect!&nbsp; exactly what I was after.&nbsp;&nbsp;</P><P>Many thanks.</P> Thu, 26 Oct 2023 00:35:19 GMT https://community.splunk.com/t5/Splunk-Search/stats-count/m-p/666266#M228564 splunk_novice99 2023-10-26T00:35:19Z