topic How can I retrieve count or distinct count of some field values ? in Splunk Search

How can I retrieve count or distinct count of some field values ?

gpant — Thu, 14 Jan 2016 06:05:54 GMT

I have lots of logs for client order id ( field_ name is clitag ), i have to find unique count of client order( field_ name is clitag ) received so far that day?

Re: How can I retrieve count or distinct count of some field values ?

javiergn — Thu, 14 Jan 2016 11:44:00 GMT

In principle I would use stats count or stats dc(fieldname) but I need more information about your data.
Can you post some events and give us an example of what you are trying to achieve?

Re: How can I retrieve count or distinct count of some field values ?

gyslainlatsa — Thu, 14 Jan 2016 11:55:08 GMT

hi gpant,

try uses the function values() used to have these distinct values and dc () to get the number of distinct values.

for more informations, follow this link:

http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/CommonStatsFunctions

Re: How can I retrieve count or distinct count of some field values ?

Richfez — Thu, 14 Jan 2016 12:27:41 GMT

I tried answering but realized it's all guesswork and probably wrong until we get a few events to look at.

It is possible it's something like

... my search earliest=@d | stats dc(client_ag)

But it's too hard to tell.

Could you provide a few events and describe the important pieces for us?

Re: How can I retrieve count or distinct count of some field values ?

gpant — Fri, 15 Jan 2016 10:57:47 GMT

thanks for your help, i tried this and it is working fine 🙂

Re: How can I retrieve count or distinct count of some field values ?

gpant — Fri, 15 Jan 2016 11:00:34 GMT

i tried these, and it is working ..

Re: How can I retrieve count or distinct count of some field values ?

gpant — Fri, 15 Jan 2016 11:00:57 GMT

hello, dc(filed_name) is working.. thank you