Splunk Search

How can I get a stats count number of events in a field?

knarayana
New Member

how to do a - stats count number of events in a field?

index=sm auth | status count(events) by Field.

is not working.

Thanks
Kiran

0 Karma

nsanzar_splunk
Splunk Employee
Splunk Employee

Came across this while looking and saw it was still unresolved.  In essence, you are asking to provide count by Field.  You will have to specify field as you cannot simply ask to display count by field.  The example below takes data from index=sm where "auth" is present and to provide number of events by host,user

 

For example:

index=sm auth | stats count by host, user

 

0 Karma

knarayana
New Member

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The | stats count by Field will provide you field value and count of events which have that value. Could you provide what you expect with some example data?

0 Karma

FrankVl
Ultra Champion

Not entirely sure what you mean by "number of events in a field", but counting events simply works by doing "count", like:

index=sm auth | stats count by Field
0 Karma

knarayana
New Member

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

0 Karma

FrankVl
Ultra Champion

Can you by any chance post some screenshot of the result you get and then describe the desired outcome, because I still don't understand what you mean by "the number of events in that field" and what you mean by that stats command returns each event AND its count.

0 Karma

493669
Super Champion

have you tried this:

index=sm  | stats count by Field 
0 Karma

knarayana
New Member

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

0 Karma

493669
Super Champion

so are you expecting total number of events then try simply stats count like:

 index=sm auth  | stats count
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...