Splunk Search
Highlighted

How to modify my search to add the count of a particular field next to its field?

Builder

I have a search as follows

My search | bin span=1h _time | stats values(field_1) as Field_1 by _time Field_2

Which displays the result as follows

_time        Field_2        Field_1
123          jkl            gsad

Now I want my search to modify the result to add a field which displays the total event count of Field1(Field1_count) next to it like below. How can i do that?

_time        Field_2        Field_1         Field_1_count
123          jkl            gsad            23
0 Karma
Highlighted

Re: How to modify my search to add the count of a particular field next to its field?

SplunkTrust
SplunkTrust

Try this

My search | bin span=1h _time | stats values(field_1) as Field_1 count(field_1) as Field_1_count by _time Field_2
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma