Splunk Query Count of Count

Question

I want to know the count of a count of a query. The query is

sourcetype="cargo_dc_shipping_log" OR sourcetype="cargo_dc_deliver_log" | stats count by X_REQUEST_ID | sort - count

So you can see there are multiple rows with the value of 3.

Thanks in advance

Answer 1

You're goal in this particular case is to get a summary of counts for this X_REQUEST_ID field, right?

Let's take your initial query:

sourcetype="cargo_dc_shipping_log" OR sourcetype="cargo_dc_deliver_log" | stats count by X_REQUEST_ID | sort - count

What we're missing here is how to aggregate against your aggregation. Then, we can sort:

sourcetype="cargo_dc_shipping_log" OR sourcetype="cargo_dc_deliver_log" | stats count as req_count by X_REQUEST_ID | stats count by req_count | sort - count

Let me know if that works out for you.

Answer 2

You could pipe another stats count command at the end of your original query like so:

sourcetype="cargo_dc_shipping_log" OR sourcetype="cargo_dc_deliver_log" | stats count by X_REQUEST_ID | stats count

This would give you a single result with a count field equal to the number of search results.

Answer 3

Simple Just pipe your search to stats count.

...your search query|stats count