Splunk Search

How to get a stats count on multiple fields in a table sorted by count?

adicoza786
Explorer

Hi All,

I am trying to get the count of different fields and put them in a single table with sorted count.

stats count(ip) | rename count(ip) as count |
append [stats count(login) | rename count(login) as count] | 
append [ stats count(bcookie) | rename count(bcookie) as count]

I seem to be getting the following output:

count 
10
20
30

However, I need the output to be something like this:

 name        count 
 ip          10
 login       20
 bcookie     30

Thanks in advance.
Aditya

0 Karma
1 Solution

jluo_splunk
Splunk Employee
Splunk Employee

You could simply do..

 stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.

However, the format of the results table is a little different from what you requested.

View solution in original post

manideeplanka
New Member

I have a similar usecase all though a little extra is needed...I need count by bcookie and ip.

Then
stats count(ip) as ip by ip, count(bcookie) as bcookie by bcookie
is not working 😞

0 Karma

jluo_splunk
Splunk Employee
Splunk Employee

You could simply do..

 stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie.

However, the format of the results table is a little different from what you requested.

adicoza786
Explorer

I need to construct a pie chart based on these counts.

Your above query will give me the following o/p-

ip login bcookie
20 30 50

Is there a way I construct a pie chart out of these with 20% for ip 30% for login and 50% for bcookie

0 Karma

adicoza786
Explorer

I got it. The following gives the result I am expecting

stats count(ip) as ip, count(login) as login, count(bcookie) as bcookie | transpose

jluo_splunk
Splunk Employee
Splunk Employee

Glad you figured it out!

0 Karma

adicoza786
Explorer

Thanks jluo for your help

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...