I'm using Splunk to interrogate web logs. Users of our site can select one or more parameters in their data requests, identified as p=<param>. I want to get a count by parameter; however, when I use stats count by p, Splunk only picks up the first p=<> in the list. The others are ignored. Therefore to get the information, I'm performing searches by pattern (essentially a regex) but it's time consuming since there are 200+ parameters. Is there another way? Or do I need to write a script?
p=grid_id&p=swv_dwn&p=ret_tlt0&p=no_sun1&p=T10M&p=wspd10arpt&p=RAIN&p=srf_alb