title: How to count results in Splunk and put them in a table?
body: <p>I am trying to create a table in Splunk that contains several fields that were extracted plus a count of the total number entries that get returned when I give Splunk a string to search for. The issue I am having is that when I use the stats command to get a count of the results that get returned and pipe it to the table, it just leaves all of the fields blank but show a value for the count of the results returned. Without the count logic, the table shows all of the values I am after. Below is my example query:</p>
  
  <pre><code>index=test "Failed to find file"
  | table host, sourceUser, sourceApp, source
  | rename host as "Server", sourceUser as "User", sourceApp as "Application", source as "Log"
  </code></pre>
  
  <p>Here are the example results (in two line CSV since I can't post a pic):</p>
  
  <p>Server,User,Application,Log</p>
  
  <p>myserver1,joesmith,RadomApp,C:\Users\Joe\Log.txt</p>
  
  <p>That will return all of the fields I asked for. If I add the stats command (like shown below), it returns a table with all of the columns but the only one that has data is the "Error Count" column:</p>
  
  <pre><code>index=test "Failed to find file"
  | stats count as error
  | table host, sourceUser, sourceApp, source, error
  | rename host as "Server", sourceUser as "User", sourceApp as "Application", source as "Log", error as "Error Count"
  </code></pre>
  
  <p>Example results:</p>
  
  <p>Server,User,Application,Log,ErrorCount</p>
  
  <p>,,,,1</p>
  
  <p>Any idea of what the best way to go about this is?</p>