topic New to splunk, looking for total calculator by week in Getting Data In

New to splunk, looking for total calculator by week

teegarden7070 — Wed, 30 Jun 2021 15:13:55 GMT

So far I think I have the syntax built out like this

index=tool OR index=tool2 OR index=tool3
| eval parta=(index=tool information, information | stats count)
| eval partb=(index=tool2 information, information | stats count)
| eval partc=(index=tool3 information, | stats count)
| table parta partb partc

Thinking this will get me totals for the separate tools, but I'm looking to get just 1 total, per week if possible. I was thinking addtotals would help, but not sure. Any and all help would be very appreciated.

Re: New to splunk, looking for total calculator by week

ITWhisperer — Wed, 30 Jun 2021 15:25:26 GMT

Try something like this

index=tool OR index=tool2 OR index=tool3 | bin _time span=1w | stats count by index _time

Re: New to splunk, looking for total calculator by week

kamlesh_vaghela — Thu, 01 Jul 2021 07:13:42 GMT

@teegarden7070

Are you looking for something this?

Just execute for last 7 days OR week.

index=tool OR index=tool2 OR index=tool3 | stats count by index | addcoltotals

index=tool OR index=tool2 OR index=tool3 | stats count

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: New to splunk, looking for total calculator by week

teegarden7070 — Wed, 30 Jun 2021 16:03:08 GMT

Awesome thanks for the help! I guess the timeframe isn't such a huge deal because I can adjust the parameters of the search, the problem I'm having is the search itself. Each one of the tools has a separate event that I want to use to find the total count of event. All the other fields do not necessarily help with a total count. So all in all I want to index a tool, then get a total count by event in that tool, then be able to display it. If I'm not making sense feel free to critique my thinking.

Re: New to splunk, looking for total calculator by week

teegarden7070 — Wed, 30 Jun 2021 16:12:46 GMT

For example, if I use the index= all tools, and then add a field where it doesnt count all the events, only a few

Re: New to splunk, looking for total calculator by week

ITWhisperer — Wed, 30 Jun 2021 16:31:28 GMT

Can you share some sample events from the different indexes showing the different events you want to count? Best to share these in code blocks </> so they are easier to use for testing solutions.

Re: New to splunk, looking for total calculator by week

teegarden7070 — Wed, 30 Jun 2021 18:29:03 GMT

Sure, I can try, but I would like to stay as generic as possible:

index=tool1 OR index=tool2 OR index=too3

So I would like to index the 3 of these tools, but search for specific fields with each tool. Lets say,

tool1 field I want is called field 1, tool 2 is called field 2, and tool 3 is called field 3.

I hate to be so vague, and I really do appreciate the help. I can do a:

|stats count by field 1, but not sure how to get the counts and display all 3 fields.

Re: New to splunk, looking for total calculator by week

kamlesh_vaghela — Thu, 01 Jul 2021 07:22:34 GMT

@teegarden7070

With this use case I would like to suggest to go with below approach where we fetch only those event which have specific fields as you mentioned from below search.

(index=tool1 field1=*) OR (index=tool2 field2=*) OR (index=too3 field3=*)

After this just do stats by index.

| stats count by index

at this level the index will have the count which has specific field.

You can add | addcoltotals command or remove by index from above search.

like,

(index=tool1 field1=*) OR (index=tool2 field2=*) OR (index=too3 field3=*) | stats count by index | addcoltotals

(index=tool1 field1=*) OR (index=tool2 field2=*) OR (index=too3 field3=*) | stats count

To get weekly count you can try this also.

(index=tool1 field1=*) OR (index=tool2 field2=*) OR (index=too3 field3=*) | bin _time span=w | stats count by index _time

I hope this will help you.

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

Re: New to splunk, looking for total calculator by week

teegarden7070 — Thu, 01 Jul 2021 12:41:10 GMT

This is great! Thank you so much for all of your help!