https://community.splunk.com/t5/Splunk-Search/How-to-fetch-results-by-grouping-the-fields-with-a-condition/m-p/273505#M82455 <P>Try this</P> <PRE><CODE>your base search | stats dc(txt_id) as "count of txn_id" by txn_chain_id </CODE></PRE> Fri, 09 Sep 2016 22:29:01 GMT somesoni2 2016-09-09T22:29:01Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-results-by-grouping-the-fields-with-a-condition/m-p/273504#M82454 <P>Hi Team,</P> <P>I have fields like <STRONG>txn_id</STRONG> and <STRONG>txn_chain_id</STRONG> where <STRONG>txn_chain_id</STRONG> can have more than 1 <STRONG>txn_id</STRONG> like:</P> <PRE><CODE>Log 1: .....txn_id=100 txn_chain_id=1000 Log 2: .....txn_id=101 txn_chain_id=1000 Log 3: .....txn_id=102 txn_chain_id=1000 Log 4: .....txn_id=201 txn_chain_id=2000 Log 5: .....txn_id=202 txn_chain_id=2000 </CODE></PRE> <P>And so on.</P> <P>I wish to write a search which gives me output as below, dynamically pulling all the <STRONG>txn_chain_ids</STRONG> having <STRONG>txn_ids</STRONG> &gt; 1.</P> <PRE><CODE>txn_chain_id count(txn_id) 1000 3 2000 2 </CODE></PRE> <P>Can someone help me getting the search?<BR /> Please do the needful.</P> Tue, 29 Sep 2020 10:56:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-results-by-grouping-the-fields-with-a-condition/m-p/273504#M82454 iamsgsn 2020-09-29T10:56:11Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-results-by-grouping-the-fields-with-a-condition/m-p/273505#M82455 <P>Try this</P> <PRE><CODE>your base search | stats dc(txt_id) as "count of txn_id" by txn_chain_id </CODE></PRE> Fri, 09 Sep 2016 22:29:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-results-by-grouping-the-fields-with-a-condition/m-p/273505#M82455 somesoni2 2016-09-09T22:29:01Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-results-by-grouping-the-fields-with-a-condition/m-p/273506#M82456 <P>Thanks. It worked.</P> Fri, 09 Sep 2016 23:30:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-results-by-grouping-the-fields-with-a-condition/m-p/273506#M82456 iamsgsn 2016-09-09T23:30:33Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-results-by-grouping-the-fields-with-a-condition/m-p/273507#M82457 <P>Great.. Please close the question by clicking on the Accept.</P> Fri, 09 Sep 2016 23:40:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-results-by-grouping-the-fields-with-a-condition/m-p/273507#M82457 somesoni2 2016-09-09T23:40:15Z