Splunk Search

How to add a new column in my chart with a new event count after using the dedup command?

guillecasco
Path Finder

I have a search like this:

search| stats count by errortype

which is quite simple and returns:

errortype   count
1600         45
1234         60

Now I want to add in same chart a new column using the dedup command (that I already have and works), but filters a new result with less logs count. I would like to have something like:

errortype count newcount

How can I do it?

0 Karma
1 Solution

sundareshr
Legend

You could either do a | stats count dc(field) as distinct by errortype or use appendcols like this

.. | stats count by errortype | appendcols [ search ... | dedup field | stats count as distinct by errortype  ]

View solution in original post

sundareshr
Legend

You could either do a | stats count dc(field) as distinct by errortype or use appendcols like this

.. | stats count by errortype | appendcols [ search ... | dedup field | stats count as distinct by errortype  ]

guillecasco
Path Finder

thanks budy, appendcols worked perfectly

0 Karma

ppablo
Retired

@guillecasco Glad you found your answer through @sundareshr !

Since it has a working solution, don't forget to resolve the question by clicking "Accept" directly below sundareshr's post.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...