Using the Summary Index for reporting

Yancy — Wed, 29 Dec 2010 03:24:43 GMT

I'm trying to make a UserAgent report on from a summary index that I'm populating with a count for each browser/os that hits IIS.

sourcetype="iis*" earliest=-2h@h latest=-1h@h
|rex "(?i)\\(compatible;\\+MSIE(?P<MSIE>[^;]+)"
|rex "(?i)\\+Chrome/(?P<Chrome>[^\\+]+)"
|rex "(?i)\\+.*?Firefox/(?P<Firefox>\\d+\\.\\d+\\.\\d+)(?=\\+)"
|rex "(?i)\\+.*?;\\+\\w+\\+(?P<Windows>\\w+\\+\\d+\\.\\d+)(?=;)"
|rex "(?i)OS+\\+X\\+(?P<OSX>[^;]+)"
|rex "(?i)\\+Version/(?P<Safari>[^/]+)"
|rex "(?i)^(?:[^ ]* ){9}+Opera\\/(?P<Opera>[^\\(]+)"
|rex "(?i)\\+Ubuntu/(?P<Ubuntu>\\d+\\.\\d+)"
|sistats count(Firefox) as FFcnt, count(MSIE) as IEcnt, count(OSX) as OSXcnt, count(Windows) as Wincnt, count(Safari) as Safcnt, count(Chrome) as Chrcnt, count(Opera) as Oprcnt, count(Ubuntu) as Ubucnt, count(_raw) as rawcnt

I can see that the search is running and populating the index with fields named "psrsvd_ct_Chrome" etc. These however appear to be reserved for internal use by Splunk.

How can I use this data now that I've added it to the Summary index? Specifically, I want to run a timechart against it. I'm using v4.1.6

Re: Using the Summary Index for reporting

gkanapathy — Wed, 29 Dec 2010 03:51:51 GMT

Generally you retrieve the data from the summary index using the timechart or stats search commands, specifying the fields and aggreators you want, e.g.:

index=mysummaryindex source=mysummaryname | stats count(Firefox)

index=mysummaryindex source=mysummaryname | timechart count(MSIE) as IECount, count(Windows) as Count_of_Windows

Note that the as variable clauses are basically ignored when si- commands are used to populate a summary index.

topic Re: Using the Summary Index for reporting in Splunk Search

Using the Summary Index for reporting

Re: Using the Summary Index for reporting