topic Re: Counting Specific Events Type? in Splunk Search

Counting Specific Events Type?

asarran — Tue, 22 Nov 2016 16:18:09 GMT

Good Morning, Fellow Splunkers

I have a field extraction that outputs four possible values [Example]:

Field Extraction: [Direction]

[North]
[South]
[East]
[West]

I would like to count each of event within a period of time.

I'm thinking:

index=xxxx host=xxxx Direction="*"| Stat Count ("North" "South" "East" "West")

Re: Counting Specific Events Type?

niketn — Tue, 22 Nov 2016 16:29:32 GMT

index=xxxx host=xxxx Direction="North" OR Direction="South" OR Direction="East" OR Direction="West" | stats Count by Direction

Re: Counting Specific Events Type?

Raschko — Tue, 22 Nov 2016 16:34:14 GMT

Try something like this:

yoursearch | stats count(eval(match(Direction,"North")) AS count_N count(eval(match(Direction,"South")) AS count_S count(eval(match(Direction,"East")) AS count_E count(eval(match(Direction,"West")) AS count_W

This way Splunk "evals" if the field Direction contains North and counts that.

HTH.

Re: Counting Specific Events Type?

mrgibbon — Tue, 22 Nov 2016 22:57:48 GMT

| stats count by Direction

Re: Counting Specific Events Type?

niketn — Wed, 23 Nov 2016 03:12:10 GMT

Corrected the same 🙂

Re: Counting Specific Events Type?

gcusello — Wed, 23 Nov 2016 08:46:43 GMT

Hi asarran,
try something like this

your_search direction=* | stats count by Direction

or if you want a Time distribution

your_search direction=* | timechart count by Direction

Bye.
Giuseppe

Re: Counting Specific Events Type?

woodcock — Sat, 11 Mar 2017 21:16:37 GMT

Like this:

... | stats count BY Direction