- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![robertlynch2020 robertlynch2020](https://community.splunk.com/legacyfs/online/avatars/345281.jpg)
robertlynch2020
Influencer
07-20-2022
08:10 AM
I have a basic SPL using mstat but I can't use treills with it? Any ideas why I can't select "severity"
| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" BY severity
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![robertlynch2020 robertlynch2020](https://community.splunk.com/legacyfs/online/avatars/345281.jpg)
robertlynch2020
Influencer
08-17-2022
07:51 AM
in the end i needed to add a stats to the end of my SPL to get this to work
| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![robertlynch2020 robertlynch2020](https://community.splunk.com/legacyfs/online/avatars/345281.jpg)
robertlynch2020
Influencer
08-17-2022
07:51 AM
in the end i needed to add a stats to the end of my SPL to get this to work
| mstats count("mx.process.logs") as count WHERE "index"="murex_metrics" mx.env=dell967srv.scz.murex.com:15016 BY severity
| rename count as ErrorCount
| rename severity as lvl
| stats sum(ErrorCount) as Count by lvl
| sort - ErrorCount
![](/skins/images/89D5ADE867CBAF0B5A525B7E23D83D7E/responsive_peak/images/icon_anonymous_message.png)