Finding count of grouped data

[jimjohn]

How can we find the distinct values inside a grouped values.

I use transaction to group data.Now i want to find count(filed2) for each grouped data.
host=A|transaction "field1"|stats count("field2") but not return the appropriate result.
Can anybody help.

[kristian_kolb]

Hi,

you might want to play with eventstats prior to the transaction, like so (used _internal index so that you can test the exact search);

index=_internal sourcetype=splunkd earliest=@d-1m latest=@d group=* 
| eventstats count(name) as bob 
| transaction group 
| stats first(bob)

In this case the final stats produces the same count as if it had been placed before the transaction (instead of eventstats).

Hope this helps,

/K

Please provide some more sample data, and a sketch of the desired results if this does not work.