Splunk Search

How to count one field multiple times with different condition?

Loves-to-Learn Lots

Since I am new to Splunk is there is demo query for calculating this will be helpful,Basically, i want to count one field multiple times with the different condition

Tags (2)
0 Karma

SplunkTrust
SplunkTrust

lets imagine you have a field called fruit and it has 3 unique values apple,banana,mango
you can do this:
... search for your fruit field ... | stats count by fruit
you can also do this:
... search for your fruit field ... | stats count(eval(fruit="apple") as apples count(eval(fruit="banana")) as bananas count(eval(fruit="mango")) as mangos ....

read here more:
https://docs.splunk.com/Documentation/Splunk/7.3.1/Search/Usetheevalcommandandfunctions#Example_1:_U....

note, there are other ways too

0 Karma