Splunk Search

How to count two file paths?

meisjen26
Engager

I'm very new to spiunk so bare with me. I'm trying to count the number of events on two seperate file paths and have them display in a table in sep fields. So far, I include FullFilepath="*:\*" and I exclude the particular paths I'm not interested in... for example.... FullFilePath!="E:\*" ...therefore in my search, I return a count of all filepaths that are not E.

What I would like to do is include the count for both E: file paths and non E:..but in seperate fields. Can anyone provide an example on how to do this? or a good direction? Thanks!

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | stats count(eval(FullFilePath="E:*")) AS ECount count(eval(FullFilePath!="E:*")) AS OtherCount

View solution in original post

woodcock
Esteemed Legend

Like this:

... | stats count(eval(FullFilePath="E:*")) AS ECount count(eval(FullFilePath!="E:*")) AS OtherCount

meisjen26
Engager

thanks a lot

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...