Splunk Search

How to generate a count of occurrences of distinct values?

ipicbc
Explorer

I am convinced that this is hidden in the millions of answers somewhere, but I can't find it....

I can use stats dc() to get to the number of unique instances of something i.e. unique customers. But I want the count of occurrences of each of the unique instances i.e. the number of orders associated with each of those unique customers.

Should be simple enough, just not for me. Please help.

Thanks

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

Your base search here | stats dc(order_number) BY customer

View solution in original post

woodcock
Esteemed Legend

Like this:

Your base search here | stats dc(order_number) BY customer

ipicbc
Explorer

Thanks.... but, I tried that before and I didn't get what I wanted, I got a count of the unique values. More experimentation suggests that I have been over-complicating this, because a simple stats count by customer appears to give me what I asked for. Or am I missing something?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Nope, you have found the right answer. The fact that the customer numbers are unique to each customer is incidental. You just want the count for each customer, so stats is the right tool for the job.

0 Karma

kaurinko
Communicator

Hi,

I bumped into this thread while looking for something similar. Thanks to your groundwork I came to a solution as follows:

my search
| stats count AS Usage by USERID
| stats dc(USERID) AS Users by Usage

What I would like to do is to get some sort of summary where Usage would be grouped by e.g. 0-10, 11-100,101- where the limits would of course be something depending on the problem at hand.

Any ideas how that might be accomplished?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...