Splunk Search

count the specific items from the list in Splunk

Shashank_87
Explorer

Hi, I have a list column with different values and i want to count the number of occurence of a specific value. For example I have a column temp which contain list of values like below -

temp
/review-basket
/review-basket
/review-basket
/check-your-details

Now what i want another column with a count of the occurence of /review-basket which in the above case is 3.

Any help is appreciated.

0 Karma

apoorvaarbooj
Engager

... | stats count by temp

0 Karma

vnravikumar
Champion

Hi

Try with

.....|eventstats count by temp
0 Karma

Shashank_87
Explorer

@vnravikumar I think you misunderstood. The temp column I am getting by using stats like below -

| stats min(_time) as _time, list(req_content) as temp, count(req_content) as total by uniqueId

Now, that temp column has details like above I mentioned in the question. I need another column with the count of /review-basket in the temp column.

0 Karma

rmmiller
Contributor

@Shashank_87, is your expected output is supposed to look like this?

temp count
/review-basket 3
/review-basket 3
/review-basket 3
/check-your-details 1

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...