Splunk Search

how to display stats results by values(field)

pkharbanda1021
Engager

I am using the following query and trying to display the results using stats but count by field values

search query | 
| table A B C D E
| stats count values(A) as errors values(B)  values(C)  by E

Also tried 
| stats  count by E A B C [but this messes up everything as this requires every field to have values]
Current Output 
E                                  count                  A.            B                   C    

Value1.                     10.                        X              YY               ZZZ 
                                                                  Y               ZZ              BBB

Output 
E                                  count                  A.            B                   C    

Value1.                       8.                        X              YY               ZZZ 
                                      2                          Y               ZZ              BBB

  @somesoni2 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
search query | 
| table A B C D E
| fillnull value="N/A" A B C 
| stats count by E A B C
0 Karma

pkharbanda1021
Engager

this doesn't solve my problem

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please explain what is not working for you with this method

0 Karma

pkharbanda1021
Engager

results which I am getting arent accurate and its not making any sense 
I want the count for each value you see in the first value and with the above solution this is not accurate and doesnt work

pkharbanda1021_0-1638890043433.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share the search you used to get these results?

0 Karma

pkharbanda1021
Engager

for now 
"your base search" | fillnull value=NA errors
| stats count values(traceid_id) as TraceId  by title errors

but I also tried with [this gives me completely different results and I want results by title]
"your base search" | fillnull value=NA errors traceid_id 
| stats count by title errors traceid_id 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is usually easier when you describe your issue with closer to reality examples. Try something like this

"your base search" | fillnull value=NA errors traceid_id 
| stats count by title errors traceid_id
| stats list(count) as count list(errors) as errors list(traceid_id) as traceid_id by title
0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...