Splunk Search

How do I use count multiple times in one search?

tcollins93
New Member

How do I use count multiple times in one search?

For example:

search * | stats count by f1, f2 count by f3, f4
Tags (2)
0 Karma

somesoni2
Revered Legend

Without much info, I would suggest this

search * | stats count by f1, f2 f3, f4
| appendpipe [| stats sum(count) as count by f1,f2 | eval keep=1]
| appendpipe [| stats sum(count) as count by f3,f4 | eval keep=1]
| where keep=1

gjanders
SplunkTrust
SplunkTrust

Your question is not very clear, but perhaps you are looking for eventstats?
That would allow you to run multiple stats commands over the data in different ways.

Or perhaps you want to combine your count with an eval statement? Examples are in previous posts or the documentation
The above will allow conditional counting

0 Karma

adonio
Ultra Champion

can you elaborate? maybe add some sample data and use case? if you have an idea of how you would like your results to look like it can also be very beneficial...
to your question, you can count by as many fields you want ... | stats count by f1 f2 f3 .... fN
hope it helps

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...