Splunk Search

Adding fields in stats command

smanojkumar
Contributor

Hi Splunkers!
   Good day!
   I would like to add event and detection fields in stats command, after adding in stats command, I'm not getting the expected results. I need that fields as well but I should get the expected results,

Old command 
| stats count as num by name country state scope 

Modified command
| stats count as num by name country state scope event description - giving me wrong results.

Thanks in Advance!
Manoj Kumar S

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @smanojkumar,

after the BY cluse you should add only the fields to use for aggregation.

The other fields can be added to the stats command suing the values option.

So if you want to aggregate only for name and you want the other fields, you could use:

| stats 
   count AS num 
   values(country) AS country
   values(state) AS state
   values(scope) AS scope
   values(event) AS event
   values(description) AS description
   BY name 

As you can read at https://docs.splunk.com/Documentation/SCS/current/SearchReference/StatsCommandOverview

Ciao.

Giuseppe

View solution in original post

smanojkumar
Contributor

Hi @gcusello ,
   It works, Thanks for your response!

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @smanojkumar,

after the BY cluse you should add only the fields to use for aggregation.

The other fields can be added to the stats command suing the values option.

So if you want to aggregate only for name and you want the other fields, you could use:

| stats 
   count AS num 
   values(country) AS country
   values(state) AS state
   values(scope) AS scope
   values(event) AS event
   values(description) AS description
   BY name 

As you can read at https://docs.splunk.com/Documentation/SCS/current/SearchReference/StatsCommandOverview

Ciao.

Giuseppe

Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...