More on Using Search - Splunk Essentials - page 51

Doing a count
Recall that in Chapter 2 , An Introduction to Indexing and Searching , we searched for the
term, buttercupgames and found that every occurrence of it was highlighted. Now we
want to look among the events for buttercupgames and get an idea of how many of each
product they are selling, by doing count on productId . A count is done using stats ,
and the command is stats count(X) , where X is a field. If you are looking for the
count of events, then the parentheses may be omitted, but if you're looking for the count of
each instance of a field value, you'll need parentheses. If you have 100 events where the
productID field is in 100 of them but the customerid field is only in 96 of them,
stats count(customerId) BY ProductId would yield a different result than
stats count BY productID .
Note
Field names are case sensitive. HOST is not the same as host , so be careful when specify-
ing field names.
Notice that when we enter the following:
buttercupgames | stats count (productId)
(Notice that the field productId has a capital I.), we get the following: