Splunk Enterprise

Count number of events by a value(ServiceName) in log file

vineetc
Engager

I want to count number of events in the log file based on a serviceName and then plot them with Counts by ServiceName

Sample LogFile:

<Timestamp> Invoked Service1
<Timestamp> Invoked Service2
<Timestamp> Invoked Service3
<Timestamp> Invoked Service3
<Timestamp> Invoked Service1
<Timestamp> Invoked Service2
<Timestamp> Invoked Service1

I should get the count of invocation by service

Tags (1)
0 Karma

somesoni2
Revered Legend

If the field ServiceName is already extracted try this

your base search | stats count by ServiceName

OR

your base search | timechart count by ServiceName
0 Karma
Get Updates on the Splunk Community!

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Combine Multiline Logs into a Single Event with SOCK: a Step-by-Step Guide for ...

Combine multiline logs into a single event with SOCK - a step-by-step guide for newbies Olga Malita The ...