Splunk Search

how to display stats results by values(field)

pkharbanda1021
Engager

I am using the following query and trying to display the results using stats but count by field values

search query | 
| table A B C D E
| stats count values(A) as errors values(B)  values(C)  by E

Also tried 
| stats  count by E A B C [but this messes up everything as this requires every field to have values]
Current Output 
E                                  count                  A.            B                   C    

Value1.                     10.                        X              YY               ZZZ 
                                                                  Y               ZZ              BBB

Output 
E                                  count                  A.            B                   C    

Value1.                       8.                        X              YY               ZZZ 
                                      2                          Y               ZZ              BBB

  @somesoni2 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
search query | 
| table A B C D E
| fillnull value="N/A" A B C 
| stats count by E A B C
0 Karma

pkharbanda1021
Engager

this doesn't solve my problem

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please explain what is not working for you with this method

0 Karma

pkharbanda1021
Engager

results which I am getting arent accurate and its not making any sense 
I want the count for each value you see in the first value and with the above solution this is not accurate and doesnt work

pkharbanda1021_0-1638890043433.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share the search you used to get these results?

0 Karma

pkharbanda1021
Engager

for now 
"your base search" | fillnull value=NA errors
| stats count values(traceid_id) as TraceId  by title errors

but I also tried with [this gives me completely different results and I want results by title]
"your base search" | fillnull value=NA errors traceid_id 
| stats count by title errors traceid_id 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is usually easier when you describe your issue with closer to reality examples. Try something like this

"your base search" | fillnull value=NA errors traceid_id 
| stats count by title errors traceid_id
| stats list(count) as count list(errors) as errors list(traceid_id) as traceid_id by title
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...