Splunk Search

How to get field count rather than stats count?

summitsplunk
Communicator

Here's my query:

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats count by devtype

What I want to do is get something like this :

devtype

iphone 100
windows 105
Android 200

I don't want stats on all of the events. I just want the totals of of all the possibilities for the devtype Field. How would I write this?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
0 Karma

PowerPacked
Builder

Hi

Are you looking for this

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats count(devtype) as count

& if you are looking for distinct count - index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
but this only gives the unique values & count of devtype field which is not you are looking for i guess.

Thanks

summitsplunk
Communicator

Yeah what you said "index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
but this only gives the unique values & count of devtype field" is exactly right. So I was asking the question sort of wrong.

ultimately my query ended up looking like this to give me my desired output:
index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(src_mac) by devtype

which give me a count of src_mac and groups them by devtype

0 Karma

Vijeta
Influencer

@summitsplunk Can you be more clear, looking at the desired output you have shared your query looks correct , do you have some sample data with output example?

0 Karma

summitsplunk
Communicator

Figured it out. So I just didn't know how to ask the question but with some googling I found the write term which is "Distinct Count"... Basically I wanted to get a distinct count of each field. Like seen in this article:

https://answers.splunk.com/answers/46241/how-can-i-retrieve-count-or-distinct-count-of-some-field-va...

0 Karma
Get Updates on the Splunk Community!

Transforming Financial Data into Fraud Intelligence

Every day, banks and financial companies handle millions of transactions, logins, and customer interactions ...

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...