topic How do I write a search to display a table with the count of each value for a field? in Splunk Search

How do I write a search to display a table with the count of each value for a field?

abovebeyond — Tue, 11 Aug 2015 11:05:04 GMT

Hello,

My data looks like:

I currently have this search:

source=myapp test123 | stats count by type

The results are:

type ........ count
1234 ........... 2
123 ........ .. 1
456 .......... 6

I just want to show the count result and another criteria from the logs in a table. Is it possible?

thanks

Re: How do I write a search to display a table with the count of each value for a field?

richgalloway — Tue, 11 Aug 2015 12:05:51 GMT

What does your data look like? What is the "other criteria"?

Re: How do I write a search to display a table with the count of each value for a field?

abovebeyond — Tue, 11 Aug 2015 12:23:15 GMT

my data looks like :

i want to show in table :

Mname .............. count (of type)

myprime .............. 3
myprime 2 ............ 1

hope you understand

Re: How do I write a search to display a table with the count of each value for a field?

skoelpin — Tue, 11 Aug 2015 12:40:57 GMT

Yes, it's defiantly possible.. Instead of doing a stats, you can just do a table command if you want to add more columns

source=myapp test123 | table type brand color

Or if you wanted it to calculate the type and add a table, you could do.. The eval command will create a new field and do the math (size/occurance). The result of the division will be the new field "type"

source=myapp test123 | eval type=(size/occurance) | table type brand color

Re: How do I write a search to display a table with the count of each value for a field?

woodcock — Tue, 11 Aug 2015 13:27:41 GMT

You should look at all the functions that are available for the stats command and use what you need, You will probably need values, avg, last, min, and max. You just string them along like this:

source=myapp test123 | stats count avg(delay) last(status) values(color) by type

If you are gong to graph them, you should switch from stats to chart, which is a very similar command and it automatically advances populates the Visualization tab.

http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/CommonStatsFunctions