Splunk Search

How to count the number of occurences of distinct strings associated with a specific json tag across multiple events?

New Member

Hello,

I am very new to this tool. I have Splunk set up to monitor a log file and extract json being written to that file to a set of events. This part is working fine. What I want to do is to inspect the value of a "results" tag that is a part of every json object, and to count the number of times a unique value is found.

Right now I'm working with something like this:

sourcetype=logfile.txt 
 | eval success=if(result="Success",1,hit) 
...
...
...
| stats count(success)...

But that isn't really working for me. Any suggestions?
Thanks!

0 Karma

Esteemed Legend

Like this:

 ... | stats count BY result
0 Karma

SplunkTrust
SplunkTrust

Since your success field is 1 for each event that you want to count, you could do this...

 | stats sum(success) as successCount...

But i'm not sure what the value of "hit" might have been. Can you explain a little more about what you are doing in your first line?

0 Karma

Revered Legend

It would work better for us if you could add some sample events and (corresponding) mock output. Based on what could I could understand, give this a try

sourcetype=logfile.txt 
  | eval success=if(result="Success",1,hit) 
 ...
 | stats dc(success)...
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!