Splunk Search

How to Count appearance of containers per company?

janderhungrige
Observer

Hi,
I want to count the numbers of containers per company. Each data point has a container id, company id, and much more.

If I use

 

 

stats count("coreData.containerNumber") BY "coreData.companyID"

 

 

 , it somewhat works, but I don't get any returns.

also

 

 

stats dc("coreData.containerNumber") as count by "coreData.companyID" 

 

 

does not return results.

Is the code correct?

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try with single quotes around the field names rather than double quotes - alternatively, rename the fields with non-alphanumerics into names with only letters and numbers or underscores.

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...