Answer by warren for How to count the number of event based on JSON field structure in Splunk

Posted on

Try one of these 2:

index=ndx sourcetype=srctp data=*
| stats dc(data) as unique_data

Or

index=ndx sourcetype=srctp data=*
| stats values(data) as data_vals

from User warren – Stack Overflow https://stackoverflow.com/questions/65997187/how-to-count-the-number-of-event-based-on-json-field-structure-in-splunk/66036420#66036420
via IFTTT

merikebi