New comment on reddit

Does your data look something like the following:

SRC_FILE_NM_TXT=<someval> STATUS_TXT=<someval> 

If so, you can do the following:

index=ndx sourcetype=srctp SRC_FILE_NM_TXT=* STATUS_TXT="Complete*" | stats count by SRC_FILE_NM_TXT as "Complete Files" | fields - count 

April 17, 2020 at 02:44PM
via reddit https://www.reddit.com/r/Splunk/comments/g37d5e/splunk_command_stats_list_with_eval_condition_how/fnpogyp?utm_source=ifttt