Using Splunk v 5.04
I have a lookup table containing devicename,interfacename,speed . Each device name can have multiple interfaces associated with it. What I am trying to do is count the interfaces associated to a particular devicename.
|inputlookup LUTOPO | search DEVICENAME="rr1.yyz3*" AND SPEED>=10000000000 | stats count(INTERFACENAME) as count | table DEVICENAME count
The search returns a count of the interfaces but does not show the devicename in the table.
because you need a split by in your stats:
| stats count(INTERFACENAME) as count by DEVICENAME
pitshot, in the future, if another community member's answer solves your problem, please check the checkmark next to it to accept the answer. thanks!
Perfect, Thanks