Splunk Search

why this group by is not returning results?

sou128
Explorer

I've this simple search that uses BY but it's not returning any results. Without the BY clause, it's returning the correct results.

source="C:\tmp\log4j2.log" bam error errorId BY errorId

any help is appreciated, thx. I already checked the sql ref
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk

Tags (3)
0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

You will need to use the BY operator with a stats, chart or timechart commmand.

Example only :

source="C:\tmp\log4j2.log" error bam | stats count BY errorId

View solution in original post

Damien_Dallimor
Ultra Champion

You will need to use the BY operator with a stats, chart or timechart commmand.

Example only :

source="C:\tmp\log4j2.log" error bam | stats count BY errorId

View solution in original post

sou128
Explorer

got it.

| stats count(errorId) BY errorId

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!