title: Count count in splunk
body: <p>Can you do double counting in Splunk via time_span?
  I want to count the number of hits of number of fruits sold in an hour.</p>
  <p>My code:</p>
  <blockquote>
  <p>|bucket _time span=1h |eventstats count as count_in_an_hour by fruit
  time |stats count as count_count by fruit |table fruit count
  count_count  |sort count_count count</p>
  </blockquote>
  <p>I can run this with a bit of data; but because I have a huge number of data, it's taking very long and taking up a lot of space resulting in &quot;not enough space error&quot;.</p>
  <p>My sample set of data,</p>
  <pre><code>name    fruit   location time
  
  mary    apple   east 5.10
  
  ben pear    east 6.10
  
  peter   pear    east 5.50
  
  ben apple   north 7.10
  
  ben mango   north 7.40
  
  peter   mango   north 5.30
  
  mary    orange  north 7.20
  
  alice   pear    north 7.20
  
  janet   pear    north 7.20
  
  janet   mango   west 6.30
  
  janet   mango   west 5.50
  
  peter   mango   west 4.20
  
  janet   pear    west 5.50
  </code></pre>