Need count for fields value

[rakesh44]

Hi Friends,

I have two field component and eventtype, need count of component=root and component=Metrics and venttype=splunkd-log and eventtype=splunkd-access .

Am using below command but getting count of components only not eventtype, morover my data is big can we used tstats command in such case.Thanks

index="_internal" component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access | stats count by component

[rakesh44 · Accepted solution]

index="_internal" component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count, count(eval(eventtype="splunkd-log")) as Splunkd_log_count, count(eval(eventtype="splunkd-access")) as Splunkd_access_count

If you want to improve performance use below command ( Both command are working fine )

| tstats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count, count(eval(eventtype="splunkd-log")) as Splunkd_log_count, count(eval(eventtype="splunkd-access")) as Splunkd_access_count count from datamodel=internal_server WHERE component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access

[kamlesh_vaghela]

@rakesh44

Can you please try this search for performace?

| tstats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count, count(eval(eventtype="splunkd-log")) as Splunkd_log_count, count(eval(eventtype="splunkd-access")) as Splunkd_access_count count from datamodel=internal_server WHERE component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access

[rakesh44]

Thanks Kamlesh for quick reply

Tried with given command , but ending with error

Error in 'TsidxStats': The tstats / mstats command cannot apply eval function to aggregation function.

[kamlesh_vaghela]

@rakesh44

It's working for me in Splunk 7.2.3. Check below link.

https://drive.google.com/open?id=1DCEOpNokZBA6OLW6m7MxgJYVZFPcmvzz

Can you please share your search if you have changed and Splunk version information?

[rakesh44]

appreciate for your help

[rakesh44]

I dont see option to accept your answer and hence posting your answer again

[kamlesh_vaghela]

@rakesh44

Now you can mark it Accept.

[rakesh44]

Thanks Kamlesh for quick reply

Its works for me, can we expedite search its very slow , I have many events.

[kamlesh_vaghela]

@rakesh44
You can use eval() to get the count of specific value.
Check below search:

index="_internal" component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count, count(eval(eventtype="splunkd-log")) as Splunkd_log_count, count(eval(eventtype="splunkd-access")) as Splunkd_access_count