Splunk Search

Count unique values from a text result

New Member

I have the following result from a simple query:

184.168.152.54 10.10.42.61 - - [09/Oct/2013:09:14:38 -0500] "GET /tgg/api2.php?KeyID=k207238&mode=xml&i=9780486472515 HTTP/1.1" 200 23 "-" "-" 0

How can I get the unique values of KeyID and their count?

Tags (1)
0 Karma
1 Solution

Motivator

Hello

Try this:

sourcetype="yoursourcetype" | rex "KeyID=(?<KeyID>\w+)\&" | stats count by KeyID

Regards

View solution in original post

Motivator

Hello

Try this:

sourcetype="yoursourcetype" | rex "KeyID=(?<KeyID>\w+)\&" | stats count by KeyID

Regards

View solution in original post

Super Champion

Try

yoursearch | stats count by KeyID