Dashboards & Visualizations

Stats Search help

WanLohnston
Explorer

Hi Everyone

I was wondering how I would go about a stats count for 2 fields where 1 field depends on the other. 

So for example we have a field called service version and another called service operation. Operations aren't necessarily exclusive to a version but I was wondering if it was possible to do a stats count where it would display something like:

Service 1 - Operation 1: *how many* - Operation 2: *How many* and so on.

Is something like this possible? 

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

| stats count by Service, Operation

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The stats command can group results by multiple fields.  Try

| stats count by Service,Operation
---
If this reply helps you, Karma would be appreciated.

ITWhisperer
SplunkTrust
SplunkTrust

Do you mean something like this?

| stats count by Service, Operation
Get Updates on the Splunk Community!

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...

New This Month - SLO Capabilities, APM Advanced Filtering & Usage Analytics Plus ...

More for SLO Management We’re continuing to expand the built-in SLO management experience in Splunk ...

Enterprise Security Content Update (ESCU) | New Releases

In June, the Splunk Threat Research Team had 2 releases of new security content via the Enterprise Security ...