Splunk Search

How do I only return the first name listed under each Group and how do I count by Groups?

New Member

The following query just gives me results but I also need to count by each Group.

index=Container_ship action=Decision result=*
| spath "Groups{}"
| search "Groups{}"=Sedan* OR "Groups{}"=SUV*
| dedup invoice
| timechart span=1mon count by result


Results show Yes or No but I also need to count by the Groups which has more than Sedan or SUV listed like color but I also only want to count whatever name appears first in the group entry.



Labels (1)
0 Karma



To split by more than one field over _time, use bin and stats instead of timechart:

| timechart span=1mon count by result


| bin _time span=1m
| stats count by _time result "Groups{}"

This will generate results with _time, result, Groups{}, and count fields.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!