https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130353#M35510 <P>Forgot to mention that I may have other fields in my table grid query....</P> Thu, 18 Sep 2014 13:25:39 GMT vtsguerrero 2014-09-18T13:25:39Z https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130352#M35509 <P>I have a field called "Status" and I wanna count when Status=P, when Status=I, when Status=E and then use the command | table _time, P, I, E<BR /> In my database they're all just one field, I kinda have to create 3 new fields splitting'em...<BR /> Thanks in advance!</P> Thu, 18 Sep 2014 13:24:03 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130352#M35509 vtsguerrero 2014-09-18T13:24:03Z https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130353#M35510 <P>Forgot to mention that I may have other fields in my table grid query....</P> Thu, 18 Sep 2014 13:25:39 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130353#M35510 vtsguerrero 2014-09-18T13:25:39Z https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130354#M35511 <P>Hi vtsguerrero,</P> <P>take this run everywhere example and adapt it to your needs:</P> <PRE><CODE>index=_internal | stats count(eval(like(sourcetype, "splunkd"))) AS P count(eval(like(sourcetype, "%web%"))) AS I </CODE></PRE> <P>This will count <CODE>sourcetype="splunkd"</CODE> as P and <CODE>sourcetype="*web*"</CODE> as I. So if you use this on the <CODE>Status</CODE> field in your case.</P> <P>hope this helps to get you started ...</P> <P>cheers, MuS</P> Thu, 18 Sep 2014 14:03:01 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130354#M35511 MuS 2014-09-18T14:03:01Z https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130355#M35512 <P>The result table should be something like this:</P> <PRE><CODE>| table _time, Channel, Code, StatusP, StatusI, StatusE </CODE></PRE> <P>but the Status field in my database is only one field. I need to count and store'em individually</P> Thu, 18 Sep 2014 14:03:35 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130355#M35512 vtsguerrero 2014-09-18T14:03:35Z https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130356#M35513 <P>Thanks a lot @MuS !</P> <P>I knew how to the count, but for only one field, first time I use three fields at once, worked liked a charm! Tks!</P> Thu, 18 Sep 2014 14:10:09 GMT https://community.splunk.com/t5/Splunk-Search/How-To-Count-A-Field-In-3-New-Fields-And-Table-Them-Together/m-p/130356#M35513 vtsguerrero 2014-09-18T14:10:09Z