topic Re: How to count events that are common or existing among multiple sourcetypes? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285716#M86450 <P>Try this to find transactions missing a step:</P> <PRE><CODE>(sourcetype=TICKET_OPENED OR sourcetype=TICKET_ACTIVITY OR sourcetype=TICKET_CLOSED) | stats count list(SOURCETYPE) as Types by TICKET_NUMBER | where count&lt;3 </CODE></PRE> <P>Or, specific to your question:</P> <PRE><CODE>(sourcetype=TICKET_OPENED OR sourcetype=TICKET_ACTIVITY OR sourcetype=TICKET_CLOSED) | stats dc(TICKET_NUMBER) as TICKET_NUMBERS by sourcetype </CODE></PRE> Thu, 15 Sep 2016 20:16:25 GMT twinspop 2016-09-15T20:16:25Z How to count events that are common or existing among multiple sourcetypes? https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285714#M86448 <P>Seeking help of Splunk Gurus.</P> <P>I have three sourcetypes : TICKET_OPENED, TICKET_ACTIVITY &amp; TICKET_CLOSED. A common field among these three sourcetypes is TICKET_NUMBER.</P> <P>It is possible that a specific TICKET_NUMBER was opened (exists in TICKET_OPENED) but was not closed (does not exist in TICKET_CLOSED). My question is how do I count the number of distinct TICKET_NUMBER that exist in all of the three sourcetypes? </P> <P>PS - tried to look if this was previously asked but can't find any answer.</P> Tue, 29 Sep 2020 11:01:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285714#M86448 christopheryu 2020-09-29T11:01:24Z Re: How to count events that are common or existing among multiple sourcetypes? https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285715#M86449 <P>Try this</P> <PRE><CODE>index=xyz sourcetype=TICKET_OPENED OR sourcetype=TICKET_ACTIVITY OR sourcetype=TICKET_CLOSED | stats values(sourcetype) sourcetypes dc(sourcetype) as count by TICKET_NUMBER | where count=3 </CODE></PRE> Thu, 15 Sep 2016 20:11:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285715#M86449 sundareshr 2016-09-15T20:11:03Z Re: How to count events that are common or existing among multiple sourcetypes? https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285716#M86450 <P>Try this to find transactions missing a step:</P> <PRE><CODE>(sourcetype=TICKET_OPENED OR sourcetype=TICKET_ACTIVITY OR sourcetype=TICKET_CLOSED) | stats count list(SOURCETYPE) as Types by TICKET_NUMBER | where count&lt;3 </CODE></PRE> <P>Or, specific to your question:</P> <PRE><CODE>(sourcetype=TICKET_OPENED OR sourcetype=TICKET_ACTIVITY OR sourcetype=TICKET_CLOSED) | stats dc(TICKET_NUMBER) as TICKET_NUMBERS by sourcetype </CODE></PRE> Thu, 15 Sep 2016 20:16:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285716#M86450 twinspop 2016-09-15T20:16:25Z Re: How to count events that are common or existing among multiple sourcetypes? https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285717#M86451 <P>removed "sourcetypes" in the stats pipe and it's good to go, thank you!</P> Mon, 19 Sep 2016 15:59:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285717#M86451 christopheryu 2016-09-19T15:59:14Z Re: How to count events that are common or existing among multiple sourcetypes? https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285718#M86452 <P>that was meant to be <CODE>as sourcetypes</CODE></P> Mon, 19 Sep 2016 16:04:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285718#M86452 sundareshr 2016-09-19T16:04:26Z Re: How to count events that are common or existing among multiple sourcetypes? https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285719#M86453 <P>both produce the same result that I am looking for. Thanks again <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Mon, 19 Sep 2016 16:17:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285719#M86453 christopheryu 2016-09-19T16:17:34Z Re: How to count events that are common or existing among multiple sourcetypes? https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285720#M86454 <P>Thank you but not quite what I was looking for.</P> Mon, 19 Sep 2016 16:24:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-count-events-that-are-common-or-existing-among-multiple/m-p/285720#M86454 christopheryu 2016-09-19T16:24:12Z