Splunk Search

How to get count of multiple strings with common index and source type?

habisht
Explorer

I'm trying to create a dashboard which will display pie-charts from different results. For this, I've multiple strings from same index and same source type.
What I've tried:
1. get counts from each and then use in pie-chart with tokens.
2. append required search results and then use them in pie-chart.
Both are OK. but i think there might be some effective way to do this.

like: index=$index$ sourcetype=$sourcetype$ "my test string1" | count AS count1 "my test string2" | count AS count2

0 Karma
1 Solution

renjith_nair
Legend

@habisht,

Test this with one of your strings,

index=$index$ sourcetype=$sourcetype$ ("my test string1"  OR "my test string2" OR ..)
|stats count(eval(searchmatch("my test string1"))) as string1 ,count(eval(searchmatch("my test string2"))) as string2, ...
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@habisht,

Test this with one of your strings,

index=$index$ sourcetype=$sourcetype$ ("my test string1"  OR "my test string2" OR ..)
|stats count(eval(searchmatch("my test string1"))) as string1 ,count(eval(searchmatch("my test string2"))) as string2, ...
---
What goes around comes around. If it helps, hit it with Karma 🙂

habisht
Explorer

Thanks @renjith.nair it worked.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...