How can I get a stats count number of events in a field?

[knarayana]

how to do a - stats count number of events in a field?

index=sm auth | status count(events) by Field.

is not working.

Thanks
Kiran

[nsanzar_splunk]

Came across this while looking and saw it was still unresolved.  In essence, you are asking to provide count by Field.  You will have to specify field as you cannot simply ask to display count by field.  The example below takes data from index=sm where "auth" is present and to provide number of events by host,user

For example:

index=sm auth | stats count by host, user

[knarayana]

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

[somesoni2]

The | stats count by Field will provide you field value and count of events which have that value. Could you provide what you expect with some example data?

[FrankVl]

Not entirely sure what you mean by "number of events in a field", but counting events simply works by doing "count", like:

index=sm auth | stats count by Field

[knarayana]

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

[FrankVl]

Can you by any chance post some screenshot of the result you get and then describe the desired outcome, because I still don't understand what you mean by "the number of events in that field" and what you mean by that stats command returns each event AND its count.

[493669]

have you tried this:

index=sm  | stats count by Field 

[knarayana]

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

[493669]

so are you expecting total number of events then try simply stats count like:

 index=sm auth  | stats count