Splunk Search

Total event count of specific field

Contributor

My Query:

index=blah sourcetype="blah-2" | dedup User_IP

This works by extracting the unique IP's defined by the field User_IP, and the eventcount at the top of the search returns a total of say "395". What I want it to do is actually spit out the number within the search results so I can add this to a dashboard.

I can't for the life of me find the correct command to do so.

Thanks in advance!

Tags (2)
0 Karma

Legend
... | stats count

?

0 Karma