Splunk Search

How can I get a stats count number of events in a field?

New Member

how to do a - stats count number of events in a field?

index=sm auth | status count(events) by Field.

is not working.

Thanks
Kiran

0 Karma

New Member

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

0 Karma

Revered Legend

The | stats count by Field will provide you field value and count of events which have that value. Could you provide what you expect with some example data?

0 Karma

Ultra Champion

Not entirely sure what you mean by "number of events in a field", but counting events simply works by doing "count", like:

index=sm auth | stats count by Field
0 Karma

New Member

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

0 Karma

Ultra Champion

Can you by any chance post some screenshot of the result you get and then describe the desired outcome, because I still don't understand what you mean by "the number of events in that field" and what you mean by that stats command returns each event AND its count.

0 Karma

Super Champion

have you tried this:

index=sm  | stats count by Field 
0 Karma

New Member

stats count by field - gives me each event in that field and its count. i dont want that. i just want the number of events in that field.

0 Karma

Super Champion

so are you expecting total number of events then try simply stats count like:

 index=sm auth  | stats count
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!