Splunk Search

Display total count of unique values of a field?

neerajs_81
Builder

Hi,   Fundamentals question but one of those brain teasers.  How do i get a total count of distinct values of a field ?   For example, as shown below  Splunk shows my "aws_account_id" field has 100+ unique values.   What is that exact 100+ number ?  If i hover my mouse on the field, it shows Top 10 values etc. but not the total count. 

neerajs_81_0-1663306844332.png


Things i have tried as per other posts in the forum"

 

 

index=aws sourcetype="aws:cloudtrail" | fields aws_account_id 
| stats dc(count) by aws_account_id 

 

 

 
This does show me the total count (which is 156) but it shows like this:

neerajs_81_1-1663306940766.png

 

Instead i want the data in this tabular format:

Fieldname Count
aws_account_id 156

 


Thanks in advance

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @neerajs_81,

to know how many different aws_account_id you have (result is a number) , you have to use the dc option in stats command:

index=aws sourcetype="aws:cloudtrail" 
| stats dc(aws_account_id) AS aws_account_id_count

Ciao.

Giuseppe

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

that 100+ is not an exact number. It just show that this field have more than 100 different values (as you have count it is 156 in your case). One way to get your wanted output is

 

index=aws sourcetype="aws:cloudtrail" 
| fields aws_account_id 
| stats dc(count) as Count 
| eval Fieldname = "aws_account_id"
| table Fieldname Count

 

r. Ismo

neerajs_81
Builder

Thanks, karma points awarded. 

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @neerajs_81,

to know how many different aws_account_id you have (result is a number) , you have to use the dc option in stats command:

index=aws sourcetype="aws:cloudtrail" 
| stats dc(aws_account_id) AS aws_account_id_count

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @neerajs_81,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...