Splunk Search

how do I count values based on many values using a multiselect filter

Talking_Master
Explorer

Hi I am trying to count values based on values if they equal a range of values. Is that possible? 

| search fieldName=$Token $
| stats count(eval(fieldName)) AS Label by FieldName
| table FieldName

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Talking_Master,

one information: you used "fieldName" and "FieldName": are they two different fields or it's a mistyping?

if it's a mistyping, you can simplify your search:

| search fieldName=$Token $
| stats count AS Label by FieldName
| table FieldName

if they are two different fields, you don't need to use the eval in the stats count command.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...