https://community.splunk.com/t5/Splunk-Search/Count-unique-values-from-a-text-result/m-p/90338#M23209 <P>I have the following result from a simple query:</P> <P>184.168.152.54 10.10.42.61 - - [09/Oct/2013:09:14:38 -0500] "GET /tgg/api2.php?<STRONG>KeyID=k207238</STRONG>&amp;mode=xml&amp;i=9780486472515 HTTP/1.1" 200 23 "-" "-" 0</P> <P>How can I get the unique values of <STRONG>KeyID</STRONG> and their count?</P> Wed, 09 Oct 2013 14:17:41 GMT aionius 2013-10-09T14:17:41Z https://community.splunk.com/t5/Splunk-Search/Count-unique-values-from-a-text-result/m-p/90338#M23209 <P>I have the following result from a simple query:</P> <P>184.168.152.54 10.10.42.61 - - [09/Oct/2013:09:14:38 -0500] "GET /tgg/api2.php?<STRONG>KeyID=k207238</STRONG>&amp;mode=xml&amp;i=9780486472515 HTTP/1.1" 200 23 "-" "-" 0</P> <P>How can I get the unique values of <STRONG>KeyID</STRONG> and their count?</P> Wed, 09 Oct 2013 14:17:41 GMT https://community.splunk.com/t5/Splunk-Search/Count-unique-values-from-a-text-result/m-p/90338#M23209 aionius 2013-10-09T14:17:41Z https://community.splunk.com/t5/Splunk-Search/Count-unique-values-from-a-text-result/m-p/90339#M23210 <P>Try</P> <P>yoursearch | stats count by KeyID</P> Wed, 09 Oct 2013 14:21:18 GMT https://community.splunk.com/t5/Splunk-Search/Count-unique-values-from-a-text-result/m-p/90339#M23210 lukejadamec 2013-10-09T14:21:18Z https://community.splunk.com/t5/Splunk-Search/Count-unique-values-from-a-text-result/m-p/90340#M23211 <P>Hello</P> <P>Try this:</P> <PRE><CODE>sourcetype="yoursourcetype" | rex "KeyID=(?&lt;KeyID&gt;\w+)\&amp;" | stats count by KeyID </CODE></PRE> <P>Regards</P> Wed, 09 Oct 2013 14:24:05 GMT https://community.splunk.com/t5/Splunk-Search/Count-unique-values-from-a-text-result/m-p/90340#M23211 gfuente 2013-10-09T14:24:05Z