Splunk Search

How to get field count rather than stats count?

summitsplunk
Communicator

Here's my query:

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats count by devtype

What I want to do is get something like this :

devtype

iphone 100
windows 105
Android 200

I don't want stats on all of the events. I just want the totals of of all the possibilities for the devtype Field. How would I write this?

Tags (1)
0 Karma

woodcock
Esteemed Legend

Like this:

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
0 Karma

PowerPacked
Builder

Hi

Are you looking for this

index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats count(devtype) as count

& if you are looking for distinct count - index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
but this only gives the unique values & count of devtype field which is not you are looking for i guess.

Thanks

summitsplunk
Communicator

Yeah what you said "index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(devtype)
but this only gives the unique values & count of devtype field" is exactly right. So I was asking the question sort of wrong.

ultimately my query ended up looking like this to give me my desired output:
index="smt_fortigate" host="10.8.12.1" srcintf=mysummitwifi | stats dc(src_mac) by devtype

which give me a count of src_mac and groups them by devtype

0 Karma

Vijeta
Influencer

@summitsplunk Can you be more clear, looking at the desired output you have shared your query looks correct , do you have some sample data with output example?

0 Karma

summitsplunk
Communicator

Figured it out. So I just didn't know how to ask the question but with some googling I found the write term which is "Distinct Count"... Basically I wanted to get a distinct count of each field. Like seen in this article:

https://answers.splunk.com/answers/46241/how-can-i-retrieve-count-or-distinct-count-of-some-field-va...

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...