Splunk Search

Confusion with count

palisetty
Communicator

I have a source with 100,000 events. For an Interesting field "action" where it has value as "purchase" with a count of 21,000. I want to make use of stats command with count function to see the count of events in my event list.
I tried this but it is not accepting.

index="main"
| stats count(action) =" purchase" as "Total count of Purchase occurences"

What is the correct syntax, please?

Tags (2)
0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

@palisetty

Try this.

index="main" | stats count(eval(action="purchase")) as "Total count of Purchase occurences"

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@palisetty

Try this.

index="main" | stats count(eval(action="purchase")) as "Total count of Purchase occurences"

View solution in original post

0 Karma

palisetty
Communicator

Thank You. It worked

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!