Dashboards & Visualizations

How to display all events when using stats count by instead of just the one "by" field?

vwilson3
Path Finder

Hello,

I'm a Splunk novice and appreciate your patience. I'm trying to figure out how to display all of the fields listed in my search, but there is only data in the table in the one field specified in the |stats count by field3. Here is my search:

index=myindex field1="TY" field2="G"
|stats count by field3 where count >5
|fields + _time host field1 field2 field3 field4 field5
|table _time host field1 field2 field3 field4 field5

I appreciate any help, tips, or tricks!

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

That is exactly why eventstats exists. It performs the analysis of stats and sticks the answers not on a new summary but sprinkled throughout the starting events. Just switch from stats to eventstats.

View solution in original post

vwilson3
Path Finder

Thank you so much for your help! I am learning every day, for sure!

vwilson3
Path Finder

I just learned that I should upvote. Sorry about that. Not trying to be rude; just a newbie. 😉

woodcock
Esteemed Legend

That is exactly why eventstats exists. It performs the analysis of stats and sticks the answers not on a new summary but sprinkled throughout the starting events. Just switch from stats to eventstats.

richgalloway
SplunkTrust
SplunkTrust

The stats command is a filtering command. That means the only fields available downstream are those mentioned in stats. In your example, only 'count' and 'field3' are available. The fields command cannot put back what stats takes out.
For an alternative, look at the streamstats command, which adds fields to events rather than remove fields.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...