Hi,
I am new to splunk, this might have asked and answered but didn't get the answer when i searched it. here is my query: I have a base query, which basically gets the ids field(ex : 1234,3213) from different hosts. i want to get the total number of ids per host.
data:
host : ids: price: details
xyz:123:$45:example
cds:143:$45:example
Use the stats command for that.
| stats count(ids) by host
As @richgalloway but if you want unique ids, use dc(ids)
Use the stats command for that.
| stats count(ids) by host