Lookup table question

[pitshot]

Using Splunk v 5.04

I have a lookup table containing devicename,interfacename,speed . Each device name can have multiple interfaces associated with it. What I am trying to do is count the interfaces associated to a particular devicename.

|inputlookup LUTOPO | search DEVICENAME="rr1.yyz3*" AND SPEED>=10000000000 | stats count(INTERFACENAME) as count | table DEVICENAME count

The search returns a count of the interfaces but does not show the devicename in the table.

[MarioM]

because you need a split by in your stats:

| stats count(INTERFACENAME) as count by DEVICENAME

[piebob]

pitshot, in the future, if another community member's answer solves your problem, please check the checkmark next to it to accept the answer. thanks!

[pitshot]

Perfect, Thanks