https://community.splunk.com/t5/Splunk-Search/how-to-get-the-total-row-number-of-a-search-result/m-p/136297#M37272 <P>I have a search string: </P> <PRE><CODE>sourcetype=databaseError "object is null" </CODE></PRE> <P>to get the total row number of the result.</P> <P>need to display like underneath:</P> <P>object is null error: 28</P> Mon, 06 Apr 2015 19:18:44 GMT KShen 2015-04-06T19:18:44Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-total-row-number-of-a-search-result/m-p/136297#M37272 <P>I have a search string: </P> <PRE><CODE>sourcetype=databaseError "object is null" </CODE></PRE> <P>to get the total row number of the result.</P> <P>need to display like underneath:</P> <P>object is null error: 28</P> Mon, 06 Apr 2015 19:18:44 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-total-row-number-of-a-search-result/m-p/136297#M37272 KShen 2015-04-06T19:18:44Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-total-row-number-of-a-search-result/m-p/136298#M37273 <P>This is a little vague. Are you using this in a dashboard? Or just in the search bar or what? Traditionally you would use the <CODE>stats</CODE> command to get a count of events. </P> <PRE><CODE>sourcetype=databaseError "object is null" | stats count </CODE></PRE> <P>But, if you're building a dashboard then you may want the events and the count both on the dashboard. One as a single value field (using <CODE>| stats count</CODE>) and one as a table of events.</P> <P>Perhaps you could clarify your use for this in order to help folks come up with the best answer?</P> Mon, 06 Apr 2015 19:47:28 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-total-row-number-of-a-search-result/m-p/136298#M37273 dwaddle 2015-04-06T19:47:28Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-total-row-number-of-a-search-result/m-p/136299#M37274 <P>Are you looking for something more detailed than the obvious 'stats count'?</P> <P>sourcetype=databaseError "object is null" | stats count</P> Mon, 06 Apr 2015 19:47:44 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-total-row-number-of-a-search-result/m-p/136299#M37274 bill_bartlett 2015-04-06T19:47:44Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-total-row-number-of-a-search-result/m-p/136300#M37275 <P>Hello! Here is what you can do: <CODE>sourcetype=databaseError|eval object_string=case(searchmatch("object is null"),"object is null")|stats count by object_string</CODE></P> <P>You can take this as an example, with the _internal index:</P> <PRE><CODE>index=_internal|eval error_tag=case(searchmatch("error"),"error")|stats count by object_tag </CODE></PRE> Mon, 06 Apr 2015 19:51:49 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-total-row-number-of-a-search-result/m-p/136300#M37275 stephanefotso 2015-04-06T19:51:49Z