Splunk Search

Search Help

DonDandrea
Path Finder

I am stuck on creating a search. I need to sort my results by Agency and I need to list a count of all events as well as a count of all events broken down by the values in the Cause field. The search below accomplishes everything except showing the count of the Cause values.

index=dspro sourcetype=bootlogmaster force=*| stats values(Cause) count by Agency AgencyName

Any help would be greatly appreciated.

Thank you,
Don

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=dspro sourcetype=bootlogmaster force=* | stats count by Agency AgencyName Cause 
| stats list(Cause) as Cause list(count) as count sum(count) as Total by Agency AgencyName

View solution in original post

somesoni2
Revered Legend

Try this

index=dspro sourcetype=bootlogmaster force=* | stats count by Agency AgencyName Cause 
| stats list(Cause) as Cause list(count) as count sum(count) as Total by Agency AgencyName

DonDandrea
Path Finder

That worked perfectly. Thank you very much.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...