Splunk Search

Search Help

DonDandrea
Path Finder

I am stuck on creating a search. I need to sort my results by Agency and I need to list a count of all events as well as a count of all events broken down by the values in the Cause field. The search below accomplishes everything except showing the count of the Cause values.

index=dspro sourcetype=bootlogmaster force=*| stats values(Cause) count by Agency AgencyName

Any help would be greatly appreciated.

Thank you,
Don

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=dspro sourcetype=bootlogmaster force=* | stats count by Agency AgencyName Cause 
| stats list(Cause) as Cause list(count) as count sum(count) as Total by Agency AgencyName

View solution in original post

somesoni2
Revered Legend

Try this

index=dspro sourcetype=bootlogmaster force=* | stats count by Agency AgencyName Cause 
| stats list(Cause) as Cause list(count) as count sum(count) as Total by Agency AgencyName

DonDandrea
Path Finder

That worked perfectly. Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...