Splunk Search

Does count(foo) always count from a field?

Communicator

When you use count/dc/estdc in a search, does it always count from a field? For example, is: count(foo) counting the instances of the field foo?

Tags (4)
0 Karma

SplunkTrust
SplunkTrust

Yes, count(foo) will count the number of events where field foo has values (it's not null).

Communicator

Ok that really does help. So does (foo in this case) HAVE to be a field? Or can it be an object within a datamodel/something other than a field?

0 Karma

SplunkTrust
SplunkTrust

It would always be a field available in event. If the events are selected from a datamodel, the this would be a field in that datamodel (DatamodelNodeName.fieldname or similar hierarchy).