Splunk Search

How do I perform a stats count(fieldname) without it deleting all other search results output?

williamcharlton
Path Finder

I do believe I'm missing something fundamental here....

So, the search: index=X returns many events where each event has many fields. I want to add a field to each search result event that contains the count of events returned in the search. So, I attempt this by doing: index=x | stats count (oneOfTheFieldNames) AS Total. My expectation is that I'll see the list of events with all fields originally returned by the plain vanilla search index=X but each event will have a new field named Total whose value is the number of events returned in the search.

Instead, all I see is one event with one field named 'Total' whose value is the number of events that the plain vanilla search index=X returns.

How do I compose a search such that I get the list of events with all fields originally returned by the plain vanilla search index=X but with each event having a new field named Total whose value is the number of events returned in the search?

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Just use eventstats instead of stats

index=x | eventstats count (oneOfTheFieldNames) AS Total

View solution in original post

0 Karma

jason_prondak
Explorer

Try

... | eventstats count AS Total by oneOfTheFieldNames
0 Karma

vnravikumar
Champion

hi

try with eventstats

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Just use eventstats instead of stats

index=x | eventstats count (oneOfTheFieldNames) AS Total

0 Karma

williamcharlton
Path Finder

I thought I was missing something fundamental - thank-you - my search works as expected now

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...