Splunk Enterprise

How to calculate the number of distinct incidents in each jurisdiction?

scottmkirkland
Engager

I have a dataset with incident numbers and their associated Jurisdiction. It is possible that a incident will be listed in multiple jurisdictions. 

I don't want to dedup(incident_number) globally.

I need to count by jurisdiction, but the dedup or distinct count needs to be within each Jurisdiction. 

Any suggestions?

Labels (1)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

Use the by clause in stats command, e.g.

| stats count by jurisdiction

OR

| stats dc(incident_number) by jurisdiction

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

Use the by clause in stats command, e.g.

| stats count by jurisdiction

OR

| stats dc(incident_number) by jurisdiction
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...