topic Re: To Get sum of hosts in Splunk Search

To Get sum of hosts

xvxt006 — Thu, 14 Apr 2016 03:24:18 GMT

Hi,

i have a simple query where i am getting response times by host. i want to get the sum of hosts as a filed. I have to use that field in Slack.

host=xxx* sourcetype=yyyyy | stats avg(time) by host

So i have tried to use eventstats but that did not accept host as an argument. Any suggestions please?

Re: To Get sum of hosts

jkat54 — Thu, 14 Apr 2016 03:39:29 GMT

If you mean a distinct count of hosts:

 host=xxx* sourcetype=yyyyy | stats avg(time) dc(host) by host

However, with the by clause dc(host) will always equal 1 so you'll need something like appendpipe:

 host=xxx* sourcetype=yyyyy | stats avg(time) by host | appendpipe [stats dc(host)]

Maybe you're looking to addcoltotals?

 host=xxx* sourcetype=yyyyy  | stats avg(time) by host | addcoltotals fieldname=avg(time))

If you mean a sum of time by hosts:

 host=xxx* sourcetype=yyyyy | stats avg(time) sum(time) by host

If you meant something else, please explain.

There's also commands called addtotals, appendcols, append, etc. which you may be interested in.

Re: To Get sum of hosts

xvxt006 — Thu, 14 Apr 2016 03:43:11 GMT

Hi, Thank you for the reply. Say there are 4 distinct hosts, i need a filed which shows that count as 4. As i mentioned, i want to use that in Slack.

Re: To Get sum of hosts

jkat54 — Thu, 14 Apr 2016 03:55:12 GMT

Ok you want appendcols most likely:

 host=xxx* sourcetype=yyyyy | stats avg(time) by host | appendcols [search host=xxx* sourcetype=yyyyy |stats dc(host)]

Or maybe remove the by clause:

 host=xxx* sourcetype=yyyyy | stats avg(time) dc(host)

Unfortunately I have no idea what is meant by "want to use that in Slack" as I have no experience with "Slack".

Re: To Get sum of hosts

jkat54 — Thu, 14 Apr 2016 04:02:27 GMT

This is probably worth a good read too as it goes into differences between chart and stats:

https://answers.splunk.com/answers/32001/difference-between-stats-and-chart.html

Re: To Get sum of hosts

jkat54 — Thu, 14 Apr 2016 04:18:57 GMT

Hey, you gave me some points, but did I answer the question? If so, can you let us know which search worked?

Re: To Get sum of hosts

xvxt006 — Thu, 14 Apr 2016 04:27:08 GMT

Hi, Thanks for your responses. Those were helpful in finding out different options. i have used appendcols and in combination with eventstats count(eval(match(host, "^x.*"))) as TotalHosts

Re: To Get sum of hosts

ppablo — Tue, 19 Apr 2016 00:01:44 GMT

Hi @xvxt006

Glad you were able to find a solution through @jkat54 🙂 Please don't forget to resolve the post by clicking "Accept" directly below his answer. This will make it easier to find for other users with similar questions.