Splunk Search

How can I get a stats count number of events in a field?

knarayana
New Member

how to do a - stats count number of events in a field?

index=sm auth | status count(events) by Field.

is not working.

Thanks
Kiran

0 Karma

Symon
Explorer

Try

| tstats count where index=sm
0 Karma

nsanzar_splunk
Splunk Employee
Splunk Employee

Came across this while looking and saw it was still unresolved.  In essence, you are asking to provide count by Field.  You will have to specify field as you cannot simply ask to display count by field.  The example below takes data from index=sm where "auth" is present and to provide number of events by host,user

 

For example:

index=sm auth | stats count by host, user

 

0 Karma

knarayana
New Member

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

0 Karma

somesoni2
Revered Legend

The | stats count by Field will provide you field value and count of events which have that value. Could you provide what you expect with some example data?

0 Karma

FrankVl
Ultra Champion

Not entirely sure what you mean by "number of events in a field", but counting events simply works by doing "count", like:

index=sm auth | stats count by Field
0 Karma

knarayana
New Member

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

0 Karma

FrankVl
Ultra Champion

Can you by any chance post some screenshot of the result you get and then describe the desired outcome, because I still don't understand what you mean by "the number of events in that field" and what you mean by that stats command returns each event AND its count.

0 Karma

493669
Super Champion

have you tried this:

index=sm  | stats count by Field 
0 Karma

knarayana
New Member

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

0 Karma

493669
Super Champion

so are you expecting total number of events then try simply stats count like:

 index=sm auth  | stats count
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...