How can we find the distinct values inside a grouped values.
I use transaction to group data.Now i want to find count(filed2) for each grouped data.
host=A|transaction "field1"|stats count("field2") but not return the appropriate result.
Can anybody help.
you might want to play with eventstats prior to the transaction, like so (used _internal index so that you can test the exact search);
index=_internal sourcetype=splunkd earliest=@d-1m latest=@d group=*
| eventstats count(name) as bob
| transaction group
| stats first(bob)
In this case the final stats produces the same count as if it had been placed before the transaction (instead of eventstats).
Hope this helps,
Please provide some more sample data, and a sketch of the desired results if this does not work.