Splunk Search

How can I count lines?

LauraBre
Communicator

hello,

This is my search:

source=tcp:5555 PURCH_DAY=06-14 PURCH_DATE=19  PURCH_MIN>44 | stats count by ID_CARDHOLDER| sort - count | where count>=5|rangemap field=count severe=10-50 elevated=3-9 default=low

My problem is that I don't able to count the number of lines that my search returns. I want to apply my rangemap on the number of lines but I don't know how I can do it because I try count(_raw) but I don't use it correctly I think.

Thx by advance,

Laura

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion
... |stats sum(linecount) AS MyTotalLines | ...

/kristian

View solution in original post

kristian_kolb
Ultra Champion
... |stats sum(linecount) AS MyTotalLines | ...

/kristian

LauraBre
Communicator

No, I want to count the total lines that my search returns, not indivduals raw events.

0 Karma

Ayn
Legend

Number of lines in what? Individual raw events? Have you checked the linecount property?

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...