topic Re: summary indexing with sisat distinct count without the list of what is counted in Knowledge Management

summary indexing with sisat distinct count without the list of what is counted

pshumate — Mon, 28 Sep 2020 12:13:17 GMT

... |sistats dc(clientip) by host

Returns :
host psrsvd_ct_clientip psrsvd_gc psrsvd_v psrsvd_vm_clientip

Where psrsvd_vm_clientip is the list of the unique ip's. All i need it the count not the detail in the summary index. What is the best way just get the dc(clientip)?

Re: summary indexing with sisat distinct count without the list of what is counted

lguinn2 — Thu, 09 Aug 2012 04:21:54 GMT

The sistats distinct count function MUST keep a list of unique ips, as the sistats command is designed to put information into a summary index. When computing the "final" distinct count from a summary index, splunk has to be able to dedup the counts from all the time periods.

When you put data into a summary index, use sistats.

When you get data from a summary index, use stats.

index=summary search_name=the_search_that_put_the_data_in | stats dc(clientip) by host

should do what you want.

Re: summary indexing with sisat distinct count without the list of what is counted

pshumate — Thu, 09 Aug 2012 14:00:23 GMT

same thing I came up with. Thanks for the help.

Re: summary indexing with sisat distinct count without the list of what is counted

splunkreal — Fri, 20 Oct 2023 13:36:49 GMT

Thanks for the solution!

We can use | sistats values(myfield) as myfield to populate summary index.