Splunk Search

Search Help

DonDandrea
Path Finder

I am stuck on creating a search. I need to sort my results by Agency and I need to list a count of all events as well as a count of all events broken down by the values in the Cause field. The search below accomplishes everything except showing the count of the Cause values.

index=dspro sourcetype=bootlogmaster force=*| stats values(Cause) count by Agency AgencyName

Any help would be greatly appreciated.

Thank you,
Don

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=dspro sourcetype=bootlogmaster force=* | stats count by Agency AgencyName Cause 
| stats list(Cause) as Cause list(count) as count sum(count) as Total by Agency AgencyName

View solution in original post

somesoni2
Revered Legend

Try this

index=dspro sourcetype=bootlogmaster force=* | stats count by Agency AgencyName Cause 
| stats list(Cause) as Cause list(count) as count sum(count) as Total by Agency AgencyName

DonDandrea
Path Finder

That worked perfectly. Thank you very much.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...