topic How do I pass a single value query output to a field? in Splunk Search

How do I pass a single value query output to a field?

twh1 — Tue, 29 Sep 2020 21:59:25 GMT

I have a requirement to print the source count from how many hosts we are collecting.

Expected output: source_count/host_count

index=main | eval host_count=[ search index=main sourcetype=log1 | dedup host | stats dc(host) as Host_Count | return $Host_Count | eval source_count=[ search index=main sourcetype=log1 | dedup source | stats dc(source) as Source_Count | return Source_Count] | eval count=source_count + "/" + host_count

Re: How do I pass a single value query output to a field?

kmaron — Wed, 14 Nov 2018 17:42:22 GMT

index=main sourcetype=log1 
| stats dc(host) as Host_Count dc(source) as Source_Count 
| eval count=Source_Count + "/" + Host_Count 
| fields count

Re: How do I pass a single value query output to a field?

twh1 — Wed, 14 Nov 2018 17:49:01 GMT

Hi @kmaron
I have two different query to fetch the data. I cann't get both count in same stats.

Re: How do I pass a single value query output to a field?

kmaron — Wed, 14 Nov 2018 17:53:42 GMT

sorry. they look the same in your example.

Try this instead then

(first base search)
| stats dc(host) as Host_Count 
| append 
    [ search (second base search)
    | stats dc(source) as Source_Count 
    | fields Source_Count] 
| stats values(Host_Count) as Host_Count values(Source_Count) as Source_Count 
| eval count=Source_Count + "/" + Host_Count 
| fields count