topic Group field value and count rather than overall count in Splunk Search

Group field value and count rather than overall count

emamedov — Mon, 11 Jan 2016 14:54:00 GMT

eventtype="product-view"|stats count list(productname) as Products by username firmname

The above is the search string that I'm using and I receive the following results:

Instead of listing an overall count of products, I would like to have a count for each individual product. Not sure how to edit the current string or add a nested stats string to accomplish the said task.

Re: Group field value and count rather than overall count

sundareshr — Mon, 11 Jan 2016 15:14:42 GMT

Try this..

eventtype="product-view"|stats count by productname

Re: Group field value and count rather than overall count

emamedov — Mon, 11 Jan 2016 15:27:30 GMT

That doesn't specifically display the username and firmname though. Please see below:

http://imgur.com/UiTNvK5

Re: Group field value and count rather than overall count

somesoni2 — Mon, 11 Jan 2016 16:14:18 GMT

Try this

eventtype="product-view"|stats count by username firmname,productname | stats list(*) as * by username firmname

Re: Group field value and count rather than overall count

emamedov — Mon, 11 Jan 2016 16:42:53 GMT

That did the trick! Thank you very much!