Splunk Search

is the stats count is count of event or count of word?

pavanae
Builder

For example I have a query like below

index=ABC | stats count by host

Does stats is the word count of all the events or character count of all events or is it just the event count?

0 Karma
1 Solution

elliotproebstel
Champion

In the example above, Splunk will count the number of events per host.

View solution in original post

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @pavanae,

Yes, It is just event count.

| stats count by host will return count of events from each host for selected time range.

stats command is not just for a event count It is more than that. Please refer below links for magical example for stats command.

http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Stats

https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/SearchReference/Stats

Thanks
Kamlesh

0 Karma

elliotproebstel
Champion

In the example above, Splunk will count the number of events per host.

0 Karma

elliotproebstel
Champion

If you'd like a count of events, words, and characters by host:

index=ABC
| rex max_match=0 "(?<words>\w+)" 
| mvexpand words 
| stats sum(eval(len(_raw))) AS character_count count(words) AS word_count count AS event_count BY host
0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...