Splunk Search

Query on stats values

New Member

| stats values(Domain), count by Short_Host gives me overall count. But i need individual count of each Domain.

| stats count by values(Domain) does not provide any results.

I am expecting the below output

Host1 --> Domain1 --> 5

        --> Domain2 --> 8

        --> Domain3 --> 1

Host2 --> Domain1 --> 9

        --> Domain2 --> 3

        --> Domain3 --> 7

Tags (1)
0 Karma
1 Solution

Legend

The by-clause expects field names, nothing else. You should take the Splunk tutorial if you haven't already, it covers things like this.

... | stats count by Short_Host,Domain

View solution in original post

0 Karma

Legend

The by-clause expects field names, nothing else. You should take the Splunk tutorial if you haven't already, it covers things like this.

... | stats count by Short_Host,Domain

View solution in original post

0 Karma

Legend

? That's exactly what you get. If you want it split up not by Short_Host AND Domain, just split by Domain.

0 Karma

New Member

is it not possible to get count for each values(Domain)

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!