Splunk Search

How do I return the number of times a specified value appears in a field?

andrew_f_trobec
Explorer

Hello,

I have a simple issue that I can't resolve, and was hoping for support. I have the following data:

OBJECT ID,NEW STATE
1,STATE ONE
1,STATE TWO
1,STATE THREE
2,STATE ONE
2,STATE TWO
2,STATE ONE

My objective is to return the amount of times that "STATE ONE" appears. I have the following code:

index = "SAMPLE INDEX" | stats count(eval("NEW STATE" = "STATE ONE")) as "COUNT"

I was hoping that this would return "COUNT" = 3, but it keeps returning 0.

What am I missing?

Any help would be greatly appreciated. Thank you!

Andrew

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

index = "SAMPLE INDEX" "NEW STATE"="STATE ONE" | stats count as "COUNT"

OR (field name with spaces should be enclosed in single quotes)

index = "SAMPLE INDEX" | stats count(eval('NEW STATE' = "STATE ONE")) as "COUNT"

View solution in original post

gokadroid
Motivator

I hope its not doing a string compare and then returning false of comparing the "NEW STATE" as a string rather than "NEW STATE" as a field with "STATE ONE". Try to extract the fieldname as single worded text like and see if it resolves:

yourQuery to return data
| rex "^(?<objectId>[^,]+),(?<newState>).*)$"
| stats count(eval(newState="STATE ONE")) as COUNT
0 Karma

somesoni2
Revered Legend

Try like this

index = "SAMPLE INDEX" "NEW STATE"="STATE ONE" | stats count as "COUNT"

OR (field name with spaces should be enclosed in single quotes)

index = "SAMPLE INDEX" | stats count(eval('NEW STATE' = "STATE ONE")) as "COUNT"

andrew_f_trobec
Explorer

Stupid double quotes! Thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...