Hello,
I am very new to this tool. I have Splunk set up to monitor a log file and extract json being written to that file to a set of events. This part is working fine. What I want to do is to inspect the value of a "results" tag that is a part of every json object, and to count the number of times a unique value is found.
Right now I'm working with something like this:
sourcetype=logfile.txt
| eval success=if(result="Success",1,hit)
...
...
...
| stats count(success)...
But that isn't really working for me. Any suggestions?
Thanks!
Like this:
... | stats count BY result
Since your success field is 1 for each event that you want to count, you could do this...
| stats sum(success) as successCount...
But i'm not sure what the value of "hit" might have been. Can you explain a little more about what you are doing in your first line?
It would work better for us if you could add some sample events and (corresponding) mock output. Based on what could I could understand, give this a try
sourcetype=logfile.txt
| eval success=if(result="Success",1,hit)
...
| stats dc(success)...