Splunk Search

Count all events matching field value?

sjs
Path Finder

My data looks something like this

sjs_0-1673402480170.png

The status can be either SUCCESS or FAILED, I want to count the total number of events that has status as FAILED and status as SUCCESS.

 

FYI: The status is not a direct field, I had to extract it out by using 

| rex "status=(?<Status>[^,]+)"

 

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust
your search and your rex...
| stats count by status

View solution in original post

sjs
Path Finder

Thanks it helped 🥳🥳🥳

0 Karma

bowesmana
SplunkTrust
SplunkTrust
your search and your rex...
| stats count by status
Get Updates on the Splunk Community!

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...