Splunk Search

stats count

splunk_novice99
Explorer

Hello again splunk experts

This is my current situation:-

job_no                field4
131                      string1 
                              string2

132                      string3
                              string4

|table job_no, field2, field4|dedup, job_no, field2
|stats count dc(field4) AS dc_field4 by job_no
|eval calc=dc_field4 * count

produces:-

job_no                                       field2                                        dc_field4                              calc

1316212
1326212

This all works fine.  The problem is that I also want to include the strings (string1,string2,string3,string4) in my table. 

Like this:-

job_no                                                                   field4                                                               field2       dc_field4     calc

131string1, string26212
132string3, string46212

 

Any help would be greatly appreciated,

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Tell the stats command you want the values of field4.

|fields job_no, field2, field4
|dedup job_no, field2
|stats count, dc(field4) AS dc_field4, values(field4) as field4 by job_no
|eval calc=dc_field4 * count

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Tell the stats command you want the values of field4.

|fields job_no, field2, field4
|dedup job_no, field2
|stats count, dc(field4) AS dc_field4, values(field4) as field4 by job_no
|eval calc=dc_field4 * count

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

splunk_novice99
Explorer

Perfect!  exactly what I was after.  

Many thanks.

Tags (1)
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...