Splunk Search

Total event count of specific field

Contributor

My Query:

index=blah sourcetype="blah-2" | dedup User_IP

This works by extracting the unique IP's defined by the field User_IP, and the eventcount at the top of the search returns a total of say "395". What I want it to do is actually spit out the number within the search results so I can add this to a dashboard.

I can't for the life of me find the correct command to do so.

Thanks in advance!

Tags (2)
0 Karma

Legend
... | stats count

?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!