Splunk Search

Display total count of unique values of a field?

neerajs_81
Builder

Hi,   Fundamentals question but one of those brain teasers.  How do i get a total count of distinct values of a field ?   For example, as shown below  Splunk shows my "aws_account_id" field has 100+ unique values.   What is that exact 100+ number ?  If i hover my mouse on the field, it shows Top 10 values etc. but not the total count. 

neerajs_81_0-1663306844332.png


Things i have tried as per other posts in the forum"

 

 

index=aws sourcetype="aws:cloudtrail" | fields aws_account_id 
| stats dc(count) by aws_account_id 

 

 

 
This does show me the total count (which is 156) but it shows like this:

neerajs_81_1-1663306940766.png

 

Instead i want the data in this tabular format:

Fieldname Count
aws_account_id 156

 


Thanks in advance

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @neerajs_81,

to know how many different aws_account_id you have (result is a number) , you have to use the dc option in stats command:

index=aws sourcetype="aws:cloudtrail" 
| stats dc(aws_account_id) AS aws_account_id_count

Ciao.

Giuseppe

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

that 100+ is not an exact number. It just show that this field have more than 100 different values (as you have count it is 156 in your case). One way to get your wanted output is

 

index=aws sourcetype="aws:cloudtrail" 
| fields aws_account_id 
| stats dc(count) as Count 
| eval Fieldname = "aws_account_id"
| table Fieldname Count

 

r. Ismo

neerajs_81
Builder

Thanks, karma points awarded. 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @neerajs_81,

to know how many different aws_account_id you have (result is a number) , you have to use the dc option in stats command:

index=aws sourcetype="aws:cloudtrail" 
| stats dc(aws_account_id) AS aws_account_id_count

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @neerajs_81,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...