topic Need count for fields value in Splunk Search

Need count for fields value

rakesh44 — Wed, 17 Apr 2019 05:10:54 GMT

Hi Friends,

I have two field component and eventtype, need count of component=root and component=Metrics and venttype=splunkd-log and eventtype=splunkd-access .

Am using below command but getting count of components only not eventtype, morover my data is big can we used tstats command in such case.Thanks

index="_internal" component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access | stats count by component

Re: Need count for fields value

kamlesh_vaghela — Wed, 17 Apr 2019 05:29:33 GMT

@rakesh44
You can use eval() to get the count of specific value.
Check below search:

index="_internal" component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count, count(eval(eventtype="splunkd-log")) as Splunkd_log_count, count(eval(eventtype="splunkd-access")) as Splunkd_access_count

Re: Need count for fields value

rakesh44 — Wed, 17 Apr 2019 05:59:56 GMT

Thanks Kamlesh for quick reply

Its works for me, can we expedite search its very slow , I have many events.

Re: Need count for fields value

kamlesh_vaghela — Wed, 17 Apr 2019 06:52:19 GMT

@rakesh44

Can you please try this search for performace?

| tstats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count, count(eval(eventtype="splunkd-log")) as Splunkd_log_count, count(eval(eventtype="splunkd-access")) as Splunkd_access_count count from datamodel=internal_server WHERE component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access

Re: Need count for fields value

rakesh44 — Wed, 17 Apr 2019 08:12:22 GMT

Thanks Kamlesh for quick reply

Tried with given command , but ending with error

Error in 'TsidxStats': The tstats / mstats command cannot apply eval function to aggregation function.

Re: Need count for fields value

kamlesh_vaghela — Wed, 17 Apr 2019 09:01:02 GMT

@rakesh44

It's working for me in Splunk 7.2.3. Check below link.

https://drive.google.com/open?id=1DCEOpNokZBA6OLW6m7MxgJYVZFPcmvzz

Can you please share your search if you have changed and Splunk version information?

Re: Need count for fields value

rakesh44 — Wed, 17 Apr 2019 11:16:51 GMT

appreciate for your help

Re: Need count for fields value

rakesh44 — Wed, 30 Sep 2020 00:06:26 GMT

index="_internal" component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access | stats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count, count(eval(eventtype="splunkd-log")) as Splunkd_log_count, count(eval(eventtype="splunkd-access")) as Splunkd_access_count

If you want to improve performance use below command ( Both command are working fine )

| tstats count(eval(component="Metrics")) as Metrics_count, count(eval(component="root")) as Root_count, count(eval(eventtype="splunkd-log")) as Splunkd_log_count, count(eval(eventtype="splunkd-access")) as Splunkd_access_count count from datamodel=internal_server WHERE component=root OR component=Metrics OR eventtype=splunkd-log OR eventtype=splunkd-access

Re: Need count for fields value

rakesh44 — Wed, 17 Apr 2019 11:19:10 GMT

I dont see option to accept your answer and hence posting your answer again

Re: Need count for fields value

kamlesh_vaghela — Wed, 17 Apr 2019 12:07:27 GMT

@rakesh44

Now you can mark it Accept.