Dashboards & Visualizations

Stats Search help

WanLohnston
Explorer

Hi Everyone

I was wondering how I would go about a stats count for 2 fields where 1 field depends on the other. 

So for example we have a field called service version and another called service operation. Operations aren't necessarily exclusive to a version but I was wondering if it was possible to do a stats count where it would display something like:

Service 1 - Operation 1: *how many* - Operation 2: *How many* and so on.

Is something like this possible? 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

| stats count by Service, Operation

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The stats command can group results by multiple fields.  Try

| stats count by Service,Operation
---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

| stats count by Service, Operation
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...