Splunk Enterprise

How to calculate the number of distinct incidents in each jurisdiction?

scottmkirkland
Explorer

I have a dataset with incident numbers and their associated Jurisdiction. It is possible that a incident will be listed in multiple jurisdictions. 

I don't want to dedup(incident_number) globally.

I need to count by jurisdiction, but the dedup or distinct count needs to be within each Jurisdiction. 

Any suggestions?

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use the by clause in stats command, e.g.

| stats count by jurisdiction

OR

| stats dc(incident_number) by jurisdiction

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use the by clause in stats command, e.g.

| stats count by jurisdiction

OR

| stats dc(incident_number) by jurisdiction
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...