Counting Specific Events Type?

[asarran]

Good Morning, Fellow Splunkers

I have a field extraction that outputs four possible values [Example]:

Field Extraction: [Direction]

[North]
[South]
[East]
[West]

I would like to count each of event within a period of time.

I'm thinking:

index=xxxx host=xxxx Direction="*"| Stat Count ("North" "South" "East" "West")

[niketnilay]

index=xxxx host=xxxx Direction="North" OR Direction="South" OR Direction="East" OR Direction="West" | stats Count by Direction

[mrgibbon]

| stats count by Direction

[niketnilay]

Corrected the same 🙂

[Raschko]

Try something like this:

yoursearch | stats count(eval(match(Direction,"North")) AS count_N count(eval(match(Direction,"South")) AS count_S count(eval(match(Direction,"East")) AS count_E count(eval(match(Direction,"West")) AS count_W

This way Splunk "evals" if the field Direction contains North and counts that.

HTH.

[gcusello]

Hi asarran,
try something like this

your_search direction=* | stats count by Direction

or if you want a Time distribution

your_search direction=* | timechart count by Direction

Bye.
Giuseppe

[woodcock]

Like this:

... | stats count BY Direction