topic Re: add fields after a stats count in Splunk Search

add fields after a stats count

Mike6960 — Thu, 16 May 2019 11:13:04 GMT

In my search i use a couple of stats counts, the problem is that after these commands I miss other that I want to use. For example _time. I dont need a count for these fields so how can I make sure they are stille available later on in the search?

My search is for example:

index=*
"message.Origin"=blabla
source="something "
| stats count(eval('logger' ="test1")) as "example",
count(eval(logger ="test2)) as "example2" by ID

After the stats I only have the fields, example, example2 and ID

Re: add fields after a stats count

adonio — Thu, 16 May 2019 12:43:26 GMT

use eventstats

Re: add fields after a stats count

richgalloway — Thu, 16 May 2019 13:11:27 GMT

@adonio means replace stats with eventstats and fields won't be dropped.

Re: add fields after a stats count

preactivity — Thu, 16 May 2019 14:38:57 GMT

Replace stats with eventstats.

index=*  "message.Origin"=blabla source="something " 
| eventstats count(eval('logger' ="test1")) as "example1", count(eval(logger ="test2)) as "example2" by ID
| table example1,example2,source,index,ID

Note: Eventstats is not good if you are concerned about the performance.

Re: add fields after a stats count

iparitosh — Thu, 16 May 2019 17:46:54 GMT

yes. eventstats keeps all fields available for next command.

Re: add fields after a stats count

Mike6960 — Thu, 16 May 2019 18:07:14 GMT

but if I use eventstats i get all the events back. So also the ones that don't match the conditions in the evals. I only want the event that (for example) where logger= "test1"

Re: add fields after a stats count

Mike6960 — Thu, 16 May 2019 18:08:12 GMT

but if I use eventstats i get all the events back. So also the ones that don't match the conditions in the evals. I only want the event that (for example) where logger= "test1"

Re: add fields after a stats count

iparitosh — Thu, 16 May 2019 18:13:47 GMT

Post event stats you can filter events with | search logger=“test1”

Re: add fields after a stats count

Mike6960 — Thu, 16 May 2019 18:20:19 GMT

ok, I wonder why I should stats or eventstats at all...... I could just use the search= instead, every tme when I think I understand Splunk I get confused

Re: add fields after a stats count

preactivity — Thu, 16 May 2019 18:23:10 GMT

Try to apply all searches at the first stage so that you will have less data for the computation.

 index=*  "message.Origin"=blabla source="something " 
| search logger="test1" OR logger="test2"
 | eventstats count(eval('logger' ="test1")) as "example1", count(eval(logger ="test2)) as "example2" by ID
 | table example1,example2,source,index,ID

Re: add fields after a stats count

Mike6960 — Thu, 16 May 2019 18:30:31 GMT

Thanks, but with the stats command I got one line per ID and the 'loggers' in columns next to it. With eventstats I get per logger one line. what I need is for every single ID just one line with the other fields in columns next to it

Re: add fields after a stats count

iparitosh — Thu, 16 May 2019 18:40:21 GMT

Try this.

index=* "message.Origin"=blabla source="something " 
| eventstats count(eval('logger' ="test1")) as "example",
count(eval(logger ="test2”)) as "example2" by ID
| stats List(field1) as field1 List(field2) as field2... List(fieldN) as fieldN max(example) max(example2) by ID

Re: add fields after a stats count

Mike6960 — Thu, 16 May 2019 19:01:36 GMT

the 'table list 'command does not seem to work when I use it as you describe

Re: add fields after a stats count

iparitosh — Thu, 16 May 2019 19:05:04 GMT

My bad it should be
... | stats list(field_name)... by ID

Edited my answer.

Re: add fields after a stats count

Mike6960 — Thu, 16 May 2019 19:06:08 GMT

I tried stats list instead but it does not seem to get the results I want

Re: add fields after a stats count

iparitosh — Thu, 16 May 2019 19:08:38 GMT

Can you explain what is the issue and provide your query here?

Re: add fields after a stats count

preactivity — Thu, 16 May 2019 19:13:40 GMT

Just add dedup after the eventstats.
index=* "message.Origin"=blabla source="something "
| search logger="test1" OR logger="test2"
| eventstats count(eval('logger' ="test1")) as "example1", count(eval(logger ="test2)) as "example2" by ID
| dedup ID
| table example1,example2,source,index,ID