Getting Data In

How do you count the number of unique values in a field to return in a new table?

russell120
Communicator

Hi,

How do I search through a field like field_a for its unique values and then return the counts of each value in a new table?
example.csv

field_a
purple
purple
purple
gold
gold
black

How do I return a table that looks like this:

newField  count
purple      3
gold        2
black       1

In reality I have hundreds of values so the query needs to be able to find all unique values, not just "purple", "gold", and "black".

Thank you.

0 Karma
1 Solution

sudosplunk
Motivator

Give this a try your_base_search | top limit=0 field_a | fields field_a count

top command, can be used to display the most common values of a field, along with their count and percentage.
fields command, keeps fields which you specify, in the output.

View solution in original post

sxddhxrthx
Engager

This can be achieved by using a simple stats count by command

your base search | stats count by field_a
0 Karma

sudosplunk
Motivator

Give this a try your_base_search | top limit=0 field_a | fields field_a count

top command, can be used to display the most common values of a field, along with their count and percentage.
fields command, keeps fields which you specify, in the output.

russell120
Communicator

I completely forgot about top. This works, thanks!

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...