Splunk Query Count of Count

splunk

Solution

You're goal in this particular case is to get a summary of counts for this X_REQUEST_ID field, right?

Let's take your initial query:

sourcetype="cargo_dc_shipping_log" OR sourcetype="cargo_dc_deliver_log" | stats count by X_REQUEST_ID | sort - count

What we're missing here is how to aggregate against your aggregation. Then, we can sort:

sourcetype="cargo_dc_shipping_log" OR sourcetype="cargo_dc_deliver_log" | stats count as req_count by X_REQUEST_ID | stats count by req_count | sort - count

Let me know if that works out for you.

Problem

I want to know the count of a count of a query. The query is ``` sourcetype="cargo_dc_shipping_log" OR sourcetype="cargo_dc_deliver_log" | stats count by X_REQUEST_ID | sort - count ``` So you can see there are multiple rows with the value of 3. Thanks in advance

Original source