https://community.splunk.com/t5/Splunk-Search/why-this-group-by-is-not-returning-results/m-p/28026#M5493 <P>got it.</P> <P>| stats count(errorId) BY errorId</P> Tue, 17 Apr 2012 02:02:14 GMT sou128 2012-04-17T02:02:14Z https://community.splunk.com/t5/Splunk-Search/why-this-group-by-is-not-returning-results/m-p/28024#M5491 <P>I've this simple search that uses BY but it's not returning any results. Without the BY clause, it's returning the correct results. </P> <P>source="C:\tmp\log4j2.log" bam error errorId BY errorId </P> <P>any help is appreciated, thx. I already checked the sql ref<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk</A></P> Tue, 17 Apr 2012 01:39:08 GMT https://community.splunk.com/t5/Splunk-Search/why-this-group-by-is-not-returning-results/m-p/28024#M5491 sou128 2012-04-17T01:39:08Z https://community.splunk.com/t5/Splunk-Search/why-this-group-by-is-not-returning-results/m-p/28025#M5492 <P>You will need to use the BY operator with a stats, chart or timechart commmand.</P> <P>Example only :</P> <PRE><CODE>source="C:\tmp\log4j2.log" error bam | stats count BY errorId </CODE></PRE> Tue, 17 Apr 2012 01:47:18 GMT https://community.splunk.com/t5/Splunk-Search/why-this-group-by-is-not-returning-results/m-p/28025#M5492 Damien_Dallimor 2012-04-17T01:47:18Z https://community.splunk.com/t5/Splunk-Search/why-this-group-by-is-not-returning-results/m-p/28026#M5493 <P>got it.</P> <P>| stats count(errorId) BY errorId</P> Tue, 17 Apr 2012 02:02:14 GMT https://community.splunk.com/t5/Splunk-Search/why-this-group-by-is-not-returning-results/m-p/28026#M5493 sou128 2012-04-17T02:02:14Z