https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90556#M23258 <P>I finally found something that works, but it is a slow way of doing it. </P> <P>index=* [|inputcsv allhosts.csv] | stats count by host | stats count AS totalReportingHosts| appendcols [| inputlookup allhosts.csv | stats count AS totalAssets]</P> Fri, 06 Jun 2014 03:03:36 GMT stevenatmit 2014-06-06T03:03:36Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90553#M23255 <P>The objective of this search is to count the number of events in a search result. This is the current search logic that I am using (which uses the linecount command):</P> <PRE><CODE>sourcetype="my_source" filter_result="hello_world" | stats sum(linecount) as Total </CODE></PRE> <P>Is there an "eventcount" command that simply counts the number of events that I can use instead of "linecount"? The reason is that linecount sometimes over-counts some results (i.e. it will count 100 when there are actually only 75 events).</P> <P>Thanks!</P> Wed, 09 Oct 2013 15:03:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90553#M23255 echojacques 2013-10-09T15:03:13Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90554#M23256 <P>Hello</P> <P>Linecount is the number of lines per event</P> <P>I guess you are looking for something like:</P> <PRE><CODE>sourcetype="my_source" filter_result="hello_world" | stats count as Total </CODE></PRE> <P>Regards</P> Wed, 09 Oct 2013 15:07:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90554#M23256 gfuente 2013-10-09T15:07:28Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90555#M23257 <P>Yes, this is exactly what I was looking for. I just tested it and it works. Thank you!</P> Wed, 09 Oct 2013 15:09:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90555#M23257 echojacques 2013-10-09T15:09:25Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90556#M23258 <P>I finally found something that works, but it is a slow way of doing it. </P> <P>index=* [|inputcsv allhosts.csv] | stats count by host | stats count AS totalReportingHosts| appendcols [| inputlookup allhosts.csv | stats count AS totalAssets]</P> Fri, 06 Jun 2014 03:03:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90556#M23258 stevenatmit 2014-06-06T03:03:36Z https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90557#M23259 <P>Here is a way to count events per minute if you search in hours:</P> <PRE><CODE>* | timechart count(_raw) span=1h </CODE></PRE> Thu, 17 Dec 2015 16:58:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-number-of-events-in-a-search-result/m-p/90557#M23259 bbialek 2015-12-17T16:58:54Z