Splunk Search

How to get field count rather than stats count?

summitsplunk
Communicator

Here's my query:

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats count by devtype

What I want to do is get something like this :

devtype

iphone 100
windows 105
Android 200

I don't want stats on all of the events. I just want the totals of of all the possibilities for the devtype Field. How would I write this?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
0 Karma

PowerPacked
Builder

Hi

Are you looking for this

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats count(devtype) as count

& if you are looking for distinct count - index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
but this only gives the unique values & count of devtype field which is not you are looking for i guess.

Thanks

summitsplunk
Communicator

Yeah what you said "index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
but this only gives the unique values & count of devtype field" is exactly right. So I was asking the question sort of wrong.

ultimately my query ended up looking like this to give me my desired output:
index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(src_mac) by devtype

which give me a count of src_mac and groups them by devtype

0 Karma

Vijeta
Influencer

@summitsplunk Can you be more clear, looking at the desired output you have shared your query looks correct , do you have some sample data with output example?

0 Karma

summitsplunk
Communicator

Figured it out. So I just didn't know how to ask the question but with some googling I found the write term which is "Distinct Count"... Basically I wanted to get a distinct count of each field. Like seen in this article:

https://answers.splunk.com/answers/46241/how-can-i-retrieve-count-or-distinct-count-of-some-field-va...

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...