Splunk Search

How to convert tabular data to distinct count

VijaySrrie
Builder

How to convert tabular data to distinct count

Hi,

I have a splunk query

| stats count by operation (under field operation we have activate and deactivate count)

vijaysri_0-1614849271363.png

How to convert it to distinct count (instead of tabular format I want only the count to be displayed)

 

Labels (2)
0 Karma

VijaySrrie
Builder

vijaysri_0-1614850598529.png

 

It is not working, I should get the result as 2

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| stats dc(operation) as count

Is that what you mean?

0 Karma

VijaySrrie
Builder

yes, this query gave me count as 1, I want the count of activate to be displayed. Better I will create the field extraction for activate and use the below query

| stats dc(activate) as count

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| where operation="activate"
| stats count by operation
0 Karma

VijaySrrie
Builder

vijaysri_0-1614851467811.png

User wanted only the numerical value to be displayed, so I used above query

| search operation="activate"
| stats count by operation
| table count

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...