topic Get Source Count value in Splunk Search

Get Source Count value

amoldesai — Tue, 29 Sep 2020 09:05:53 GMT

Hi,

The following query below returns the output as shown below :

Query:

index="79390-np" sourcetype=np-cache-v2 source="*bp_detail*" |fields deviceId,bpRuleId | join deviceId [search index="79390-np" sourcetype=np-cache-v2 source="*bp_detail*"] | join bpRuleId [search index="79390-np" sourcetype=np-cache-v2 source="*bp_summary*" bpPrimaryTechnology="*"] | eval Month=strftime(_time,"%b %Y") | stats count as "totalExceptions",dc(source) as "sourcecount", dc(deviceId) as "uniquedevices" by Month

Output:

Month totalExceptions sourcecount uniquedevices
Feb 2016 181698 1 4197
Mar 2016 550648 1 4242

Source data for Feb: bp_detail1.gz
Source data or March : bp_detail2.gz, bp_detail3.gz and bp_detail4.gz

In the query above "dc(source) as sourcecount" returns the source count as "1" . I am expecting to some how get the original source count as "3" for March
since there are three source files meeting the criteria(source="*bp_detail*" ) for month of March. I need this count to find an average month wise.Please let me know.

Thanks.

Re: Get Source Count value

martin_mueller — Mon, 14 Mar 2016 17:40:54 GMT

Remove the final |stats and look at the data you're feeding into it. I'm guessing there's only one source value for March, probably because of all those joins. Seeing through what those do for your data is impossible from over here.

For a few alternatives check out https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html

Re: Get Source Count value

amoldesai — Tue, 15 Mar 2016 16:47:43 GMT

I do know that after all the joins there is one source value for March. But how do I get the original source count . Is there a way to save the source count in a variable before those joins so that I can refer it later for average calculation.Please let me know.

Thanks

Re: Get Source Count value

martin_mueller — Tue, 15 Mar 2016 17:35:39 GMT

I don't see a point in trying to fix a bunch of joins without knowing the data and requirements for the result - it'll just end in tears.

For example, what original source count are you looking for? You have three searches, so there are three original source counts to choose from?

Re: Get Source Count value

amoldesai — Wed, 16 Mar 2016 10:07:46 GMT

Thanks for looking into it. I am looking to get the source count for bp_detail. It has three source files for March and one for Feb. I have mentioned more about it in my first mail.

Thanks