Splunk Search

counting help

splunk_gs
Explorer

i have a field called "Status" which contains "fresh" or "stale" which is distinct via host
I want to do a distinct count by status in one row

the "fresh" count is 20
the "stale" count is 1

i tried doing stats count(eval(status="fresh")) AS fresh1 count(eval(status="stale")) AS stale1 by host
it continues to give me "1" for the "fresh" count when it should be 20.

The only way this works is if i do stats count(eval(freshness="Fresh")) AS fresh1 by status.
The problem is that it splits it in two rows. I need the answers in one row.

Please Help

Tags (1)
0 Karma

Ayn
Legend

Couldn't you just do

... | chart count by host,status

?

Get Updates on the Splunk Community!

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...

Print, Leak, Repeat: UEBA Insider Threats You Can't Ignore

Are you ready to uncover the threats hiding in plain sight? Join us for "Print, Leak, Repeat: UEBA Insider ...

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...