Splunk Search

How do you use a count without a parameter?

jkrobbins
Engager

Most of the examples I've seen (still learning) use count like so:

| stats count(src_ip) as IP

but I occasionally find an example like this:

| stats count

or

| stats count as IP

Why and when would you use count without a field name? How does it even work, that is, how does it know what field to count?

I've searched the documentation and can't find any explanation for the different formats.

Tags (1)
0 Karma
1 Solution

FrankVl
Ultra Champion

A count without a field name specified, simply counts the total number of events. count(field1) counts the number of events that have field1 populated. So if every event contains field1, count and count(field1) will give the same result. But if some of your events don't contain field1, the two methods will give different results.

View solution in original post

FrankVl
Ultra Champion

A count without a field name specified, simply counts the total number of events. count(field1) counts the number of events that have field1 populated. So if every event contains field1, count and count(field1) will give the same result. But if some of your events don't contain field1, the two methods will give different results.

jkrobbins
Engager

Thank you. That makes perfect sense. I should have figured that out.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...