Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

How to get total for line count then subtotal for another field in the same query?

$
0
0

Hi - Very new to splunk.

I have the following query that gives me total count for a specific log:

LOGGING string: "log msg: stuff=<either blank="" or="" has="" a="" string="" literal="" value="">"

from this query I can get total by matching "log msg":

source=*/logs/stdout.log classname=Log "log msg" | stats count

However, I want to get that count as well the count for "stuff" where stuff=""

How can I modify the query above to get the total count for "log msg" and total count where stuff is empty string...(as a next ask possibly display in a stacked bar chart?) But raw data is fine for now.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>