topic How to use coalesce without hitting search limit in Splunk Search

How to use coalesce without hitting search limit

alc2019 — Thu, 09 May 2019 05:21:53 GMT

My data is from the same source but I would like to count the number of times a host appears on the event based on two fields criteria. How can I do that without hitting search limit?

index=my_index source=my_source
(source_host=remote* OR dest_host=remote*)
| eval name=coalesce(source_host,dest_host)
| stats count by name

Thank you very much!

Re: How to use coalesce without hitting search limit

koshyk — Thu, 09 May 2019 05:46:24 GMT

The above search seems to be good. it should be constrained by limits.conf only
What type of limit you hitting?

Re: How to use coalesce without hitting search limit

alc2019 — Wed, 30 Sep 2020 00:28:03 GMT

I was trying to apply the answer from this good post, but I cannot make it work.

The coalesce results only one side. I want to count each time a host appears on either source_host or destination_host.

https://answers.splunk.com/answers/524250/how-to-search-for-matches-in-two-different-searche.html

link text

Re: How to use coalesce without hitting search limit

woodcock — Fri, 10 May 2019 18:43:47 GMT

Try this:

index=my_index source=my_source (source_host=remote* OR dest_host=remote*)
| multireport
[ stats count by source_host]
[ stats count by dest_host ]
| eval name=coalesce(source_host,dest_host)
| fields - *_host

Re: How to use coalesce without hitting search limit

sumanssah — Fri, 10 May 2019 19:00:00 GMT

minor amendments 🙂

  index=my_index source=my_source (source_host=remote* OR dest_host=remote*)
 | multireport
 [ stats count by source_host]
 [ stats count by dest_host ]
 | eval name=coalesce(source_host,dest_host)
 | fields - *_host
 | stats sum(count) as count by name

Re: How to use coalesce without hitting search limit

woodcock — Fri, 10 May 2019 19:44:29 GMT

I agree. Missed it by >that< much.

Re: How to use coalesce without hitting search limit

woodcock — Fri, 10 May 2019 19:45:10 GMT

Except you don't need the fields - *_host in that case.