Splunk Dev

Stats (count(x) as countX, count(y) as countY) BY FIELD X

JgTheGreat
Engager

Hi,

As the title suggests, I am after a query which gives me both the values of count(x) and count(y) by fieldX to be used later on in queries.

Is this possible?

Virtual beer and kudos for the best answer.

Kr,

0 Karma
1 Solution

cmerriman
Super Champion

If I understand what you're looking for, you have two fields, which likely aren't in 100% of events, otherwise the counts would be the same.

Try something like this to get counts when fields equal a certain value:

|stats count(eval(field="x")) as x_count count(eval(field="y")) as y_count by fieldX

Or this to just count how many events are in a field called y and a field called x

|stats count(x) as x_count count(y) as y_count by fieldX

View solution in original post

cmerriman
Super Champion

If I understand what you're looking for, you have two fields, which likely aren't in 100% of events, otherwise the counts would be the same.

Try something like this to get counts when fields equal a certain value:

|stats count(eval(field="x")) as x_count count(eval(field="y")) as y_count by fieldX

Or this to just count how many events are in a field called y and a field called x

|stats count(x) as x_count count(y) as y_count by fieldX
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...