How to convert tabular data to distinct count

[VijaySrrie]

How to convert tabular data to distinct count

Hi,

I have a splunk query

| stats count by operation (under field operation we have activate and deactivate count)

How to convert it to distinct count (instead of tabular format I want only the count to be displayed)

[VijaySrrie]

vijaysri_0-1614850598529.png

It is not working, I should get the result as 2

[ITWhisperer]

| stats dc(operation) as count

Is that what you mean?

[VijaySrrie]

yes, this query gave me count as 1, I want the count of activate to be displayed. Better I will create the field extraction for activate and use the below query

| stats dc(activate) as count

[ITWhisperer]

| where operation="activate"
| stats count by operation

[VijaySrrie]

vijaysri_0-1614851467811.png

User wanted only the numerical value to be displayed, so I used above query

| search operation="activate"
| stats count by operation
| table count