How to count the number of occurences of distinct strings associated with a specific json tag across multiple events?

[dhartzog]

Hello,

I am very new to this tool. I have Splunk set up to monitor a log file and extract json being written to that file to a set of events. This part is working fine. What I want to do is to inspect the value of a "results" tag that is a part of every json object, and to count the number of times a unique value is found.

Right now I'm working with something like this:

sourcetype=logfile.txt 
 | eval success=if(result="Success",1,hit) 
...
...
...
| stats count(success)...

But that isn't really working for me. Any suggestions?
Thanks!

[woodcock]

Like this:

 ... | stats count BY result

[DalJeanis]

Since your success field is 1 for each event that you want to count, you could do this...

 | stats sum(success) as successCount...

But i'm not sure what the value of "hit" might have been. Can you explain a little more about what you are doing in your first line?

[somesoni2]

It would work better for us if you could add some sample events and (corresponding) mock output. Based on what could I could understand, give this a try

sourcetype=logfile.txt 
  | eval success=if(result="Success",1,hit) 
 ...
 | stats dc(success)...