Stats and Count log after query

[tanglong]

Hello,

I have problem with stats after query searching on splunk.

Please see detail on image.

• Data Log: this is raw index in splunk.
• Show after Query: need query for show result this table.

[tanglong]

Thanks @renjith.nair . Its working.

[renjith_nair · Accepted solution]

@tanglong,

Try

"your base search"|stats dc(src_ip) as count,values(src_ip) as src_ip by user|sort -count