Splunk Search

How do I perform a stats count(fieldname) without it deleting all other search results output?

williamcharlton
Path Finder

I do believe I'm missing something fundamental here....

So, the search: index=X returns many events where each event has many fields. I want to add a field to each search result event that contains the count of events returned in the search. So, I attempt this by doing: index=x | stats count (oneOfTheFieldNames) AS Total. My expectation is that I'll see the list of events with all fields originally returned by the plain vanilla search index=X but each event will have a new field named Total whose value is the number of events returned in the search.

Instead, all I see is one event with one field named 'Total' whose value is the number of events that the plain vanilla search index=X returns.

How do I compose a search such that I get the list of events with all fields originally returned by the plain vanilla search index=X but with each event having a new field named Total whose value is the number of events returned in the search?

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

Just use eventstats instead of stats

index=x | eventstats count (oneOfTheFieldNames) AS Total

View solution in original post

0 Karma

jason_prondak
Explorer

Try

... | eventstats count AS Total by oneOfTheFieldNames
0 Karma

vnravikumar
Champion

hi

try with eventstats

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Just use eventstats instead of stats

index=x | eventstats count (oneOfTheFieldNames) AS Total

0 Karma

williamcharlton
Path Finder

I thought I was missing something fundamental - thank-you - my search works as expected now

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...