Splunk Search

How can I retrieve count or distinct count of some field values ?

gpant
Explorer

I have lots of logs for client order id ( field_ name is clitag ), i have to find unique count of client order( field_ name is clitag ) received so far that day?

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

In principle I would use stats count or stats dc(fieldname) but I need more information about your data.
Can you post some events and give us an example of what you are trying to achieve?

View solution in original post

0 Karma

Richfez
SplunkTrust
SplunkTrust

I tried answering but realized it's all guesswork and probably wrong until we get a few events to look at.

It is possible it's something like

... my search earliest=@d | stats dc(client_ag)

But it's too hard to tell.

Could you provide a few events and describe the important pieces for us?

0 Karma

gpant
Explorer

thanks for your help, i tried this and it is working fine 🙂

0 Karma

gyslainlatsa
Motivator

hi gpant,

try uses the function values() used to have these distinct values and dc () to get the number of distinct values.

for more informations, follow this link:

http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/CommonStatsFunctions

0 Karma

gpant
Explorer

hello, dc(filed_name) is working.. thank you

0 Karma

javiergn
SplunkTrust
SplunkTrust

In principle I would use stats count or stats dc(fieldname) but I need more information about your data.
Can you post some events and give us an example of what you are trying to achieve?

0 Karma

gpant
Explorer

i tried these, and it is working ..

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...

Want to Reduce Costs, Mitigate Risk, Improve Performance, or Increase Efficiencies? ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...