Splunk Search

How do you use a count without a parameter?

jkrobbins
Engager

Most of the examples I've seen (still learning) use count like so:

| stats count(src_ip) as IP

but I occasionally find an example like this:

| stats count

or

| stats count as IP

Why and when would you use count without a field name? How does it even work, that is, how does it know what field to count?

I've searched the documentation and can't find any explanation for the different formats.

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

A count without a field name specified, simply counts the total number of events. count(field1) counts the number of events that have field1 populated. So if every event contains field1, count and count(field1) will give the same result. But if some of your events don't contain field1, the two methods will give different results.

View solution in original post

FrankVl
Ultra Champion

A count without a field name specified, simply counts the total number of events. count(field1) counts the number of events that have field1 populated. So if every event contains field1, count and count(field1) will give the same result. But if some of your events don't contain field1, the two methods will give different results.

jkrobbins
Engager

Thank you. That makes perfect sense. I should have figured that out.

0 Karma
Get Updates on the Splunk Community!

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...

From Alert to Resolution: How Splunk Observability Helps SREs Navigate Critical ...

It's 3:17 AM, and your phone buzzes with an urgent alert. Wire transfer processing times have spiked, and ...