Splunk Search
Highlighted

Counting Specific Events Type?

Path Finder

Good Morning, Fellow Splunkers

I have a field extraction that outputs four possible values [Example]:

Field Extraction: [Direction]

[North]
[South]
[East]
[West]

I would like to count each of event within a period of time.

I'm thinking:

index=xxxx host=xxxx Direction="*"| Stat Count ("North" "South" "East" "West")

0 Karma
Highlighted

Re: Counting Specific Events Type?

Legend

index=xxxx host=xxxx Direction="North" OR Direction="South" OR Direction="East" OR Direction="West" | stats Count by Direction




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Counting Specific Events Type?

Contributor

| stats count by Direction

0 Karma
Highlighted

Re: Counting Specific Events Type?

Legend

Corrected the same 🙂




| eval message="Happy Splunking!!!"


0 Karma
Highlighted

Re: Counting Specific Events Type?

Communicator

Try something like this:

yoursearch | stats count(eval(match(Direction,"North")) AS count_N count(eval(match(Direction,"South")) AS count_S count(eval(match(Direction,"East")) AS count_E count(eval(match(Direction,"West")) AS count_W

This way Splunk "evals" if the field Direction contains North and counts that.

HTH.

0 Karma
Highlighted

Re: Counting Specific Events Type?

Legend

Hi asarran,
try something like this

your_search direction=* | stats count by Direction

or if you want a Time distribution

your_search direction=* | timechart count by Direction

Bye.
Giuseppe

0 Karma
Highlighted

Re: Counting Specific Events Type?

Esteemed Legend

Like this:

... | stats count BY Direction
0 Karma