Splunk Search

How can I count lines?

LauraBre
Communicator

hello,

This is my search:

source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19  PURCH_MIN>44 | stats count by ID_CARDHOLDER| sort - count | where count>=5|rangemap field=count severe=10-50 elevated=3-9 default=low

My problem is that I don't able to count the number of lines that my search returns. I want to apply my rangemap on the number of lines but I don't know how I can do it because I try count(_raw) but I don't use it correctly I think.

Thx by advance,

Laura

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion
... |stats sum(linecount) AS MyTotalLines | ...

/kristian

View solution in original post

kristian_kolb
Ultra Champion
... |stats sum(linecount) AS MyTotalLines | ...

/kristian

LauraBre
Communicator

No, I want to count the total lines that my search returns, not indivduals raw events.

0 Karma

Ayn
Legend

Number of lines in what? Individual raw events? Have you checked the linecount property?

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...