topic Re: Counting Events? in Splunk Search

Counting Events?

MichaelCohen829 — Thu, 19 Jun 2014 15:57:13 GMT

Splunk Community,

I’d like to be able to count the number of events I have per SourceFile when my sourcetype is LogFile:

sourcetype="LogFile" SourceFile="File1”

I also have a number of other SourceFiles (“File2” , “File3” …etc…)

I’ve tried a number of things with no success as of yet – does anyone know how would I be able to count the number of events, per SourceFile within the SourceType “LogFile”?

Thank you,

Mike

Re: Counting Events?

MuS — Thu, 19 Jun 2014 16:04:45 GMT

Hi MichaelCohen829,

try something like this:

sourcetype="LogFile" OR SourceFile="File*" | stats count by sourcetype

cheers, MuS

Re: Counting Events?

martin_mueller — Thu, 19 Jun 2014 19:49:19 GMT

Counting and filtering by metadata fields such as source and sourcetype can be done much more quickly with tstats:

| tstats count where index=yourindex sourcetype="LogFile" by source

http://docs.splunk.com/Documentation/Splunk/6.1.1/SearchReference/tstats

Re: Counting Events?

MichaelCohen829 — Fri, 20 Jun 2014 18:20:14 GMT

Thank you MuS - this achieved exactly what I wanted!

Mike

Re: Counting Events?

MuS — Fri, 20 Jun 2014 18:23:07 GMT

Thanks, you're welcome