topic Retrieving stats from multiple summary reports in Splunk Search

Retrieving stats from multiple summary reports

beaumaris — Tue, 05 Apr 2011 03:51:12 GMT

What's the best way to retrieve stats from multiple reports in the summary index? We have a remote client that will use the REST API to run a search that should return 4 data points, each of which is a value calculated from a different report in our summary index. I thought we could use repeated "| search" commands but either I have the syntax incorrect or it isn't supported. As an example of the type of data being accessed:

index=summary report=unique_clients : contains Unique_Clients field which is #unique clients over time

index=summary report=4xx_errors : contains Num_Errors field which is # of 4* errors over time

I would like to run one search that combines the results of searches similar to the following:

index=summary report=unique_clients | stats sum(Unique_Clients) ...

index=summary report=4xx_errors | stats sum(NumErrors) ...

I want to return all 4 data points in one call to save on network overhead and also provide the data in a form useful to the remote client; it's silly to have them make 4 separate calls, and worse when we eventually need to return even more distinct data points to the remote clients. Thanks for any pointers,

Tom

Re: Retrieving stats from multiple summary reports

hazekamp — Tue, 05 Apr 2011 04:48:50 GMT

This would probably be done easiest w/ the 'append' search command like so:

index=summary report=unique_clients | stats sum(Unique_Clients) ... | append[search index=summary report=4xx_errors | stats sum(NumErrors) ...]

The only problem I forsee is figuring which rows should have values for which columns. It may be simple enough to ignore null column values for a given row.

Re: Retrieving stats from multiple summary reports

araitz — Tue, 05 Apr 2011 04:56:10 GMT

Why not keep it simple?

index=summary report=unique_clients OR report=4xx_errors 
| stats sum(Unique_Clients) as uc_sum sum(NumErrors) as ne_sum

Re: Retrieving stats from multiple summary reports

hazekamp — Tue, 05 Apr 2011 07:07:42 GMT

This should work as well as long as you don't have different split-by fields.

Re: Retrieving stats from multiple summary reports

sideview — Tue, 05 Apr 2011 13:23:10 GMT

a little bit of eval field1=if(isnull(field1),field2,field1) can go a long way to normalize different field spaces.