Good Morning, Fellow Splunkers
I have a field extraction that outputs four possible values [Example]:
Field Extraction: [Direction]
I would like to count each of event within a period of time.
index=xxxx host=xxxx Direction="*"| Stat Count ("North" "South" "East" "West")
index=xxxx host=xxxx Direction="North" OR Direction="South" OR Direction="East" OR Direction="West" | stats Count by Direction
Try something like this:
yoursearch | stats count(eval(match(Direction,"North")) AS count_N count(eval(match(Direction,"South")) AS count_S count(eval(match(Direction,"East")) AS count_E count(eval(match(Direction,"West")) AS count_W
This way Splunk "evals" if the field Direction contains North and counts that.
try something like this
your_search direction=* | stats count by Direction
or if you want a Time distribution
your_search direction=* | timechart count by Direction