https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301658#M90833 <P>stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.</P> Wed, 21 Feb 2018 19:06:31 GMT knarayana 2018-02-21T19:06:31Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301654#M90829 <P>how to do a - stats count number of events in a field?</P> <PRE><CODE>index=sm auth | status count(events) by Field. </CODE></PRE> <P>is not working.</P> <P>Thanks<BR /> Kiran</P> Wed, 21 Feb 2018 18:06:13 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301654#M90829 knarayana 2018-02-21T18:06:13Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301655#M90830 <P>have you tried this:</P> <PRE><CODE>index=sm | stats count by Field </CODE></PRE> Wed, 21 Feb 2018 18:09:32 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301655#M90830 493669 2018-02-21T18:09:32Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301656#M90831 <P>Not entirely sure what you mean by "number of events in a field", but counting events simply works by doing "count", like:</P> <PRE><CODE>index=sm auth | stats count by Field </CODE></PRE> Wed, 21 Feb 2018 18:10:58 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301656#M90831 FrankVl 2018-02-21T18:10:58Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301657#M90832 <P>stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.</P> Wed, 21 Feb 2018 19:06:20 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301657#M90832 knarayana 2018-02-21T19:06:20Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301658#M90833 <P>stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.</P> Wed, 21 Feb 2018 19:06:31 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301658#M90833 knarayana 2018-02-21T19:06:31Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301659#M90834 <P>stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.</P> Wed, 21 Feb 2018 19:07:01 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301659#M90834 knarayana 2018-02-21T19:07:01Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301660#M90835 <P>so are you expecting total number of events then try simply stats count like:</P> <PRE><CODE> index=sm auth | stats count </CODE></PRE> Wed, 21 Feb 2018 19:12:51 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301660#M90835 493669 2018-02-21T19:12:51Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301661#M90836 <P>Can you by any chance post some screenshot of the result you get and then describe the desired outcome, because I still don't understand what you mean by "the number of events in that field" and what you mean by that stats command returns each event AND its count.</P> Wed, 21 Feb 2018 19:16:49 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301661#M90836 FrankVl 2018-02-21T19:16:49Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301662#M90837 <P>The <CODE>| stats count by Field</CODE> will provide you field value and count of events which have that value. Could you provide what you expect with some example data?</P> Wed, 21 Feb 2018 19:31:54 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/301662#M90837 somesoni2 2018-02-21T19:31:54Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/579508#M201933 <P>Came across this while looking and saw it was still unresolved.&nbsp; In essence, you are asking to provide count by Field.&nbsp; You will have to specify field as you cannot simply ask to display count by field.&nbsp; The example below takes data from index=sm where "auth" is present and to provide number of events by host,user</P><P>&nbsp;</P><P>For example:</P><LI-CODE lang="markup">index=sm auth | stats count by host, user</LI-CODE><P>&nbsp;</P> Wed, 29 Dec 2021 18:07:28 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/579508#M201933 nsanzar_splunk 2021-12-29T18:07:28Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/685303#M233832 <P>Try<BR /><BR /></P> <LI-CODE lang="markup">| tstats count where index=sm</LI-CODE> Wed, 24 Apr 2024 12:07:48 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-stats-count-number-of-events-in-a-field/m-p/685303#M233832 Symon 2024-04-24T12:07:48Z