Splunk Search

How to get count of multiple strings with common index and source type?

habisht
Explorer

I'm trying to create a dashboard which will display pie-charts from different results. For this, I've multiple strings from same index and same source type.
What I've tried:
1. get counts from each and then use in pie-chart with tokens.
2. append required search results and then use them in pie-chart.
Both are OK. but i think there might be some effective way to do this.

like: index=$index$ sourcetype=$sourcetype$ "my test string1" | count AS count1 "my test string2" | count AS count2

0 Karma
1 Solution

renjith_nair
Legend

@habisht,

Test this with one of your strings,

index=$index$ sourcetype=$sourcetype$ ("my test string1"  OR "my test string2" OR ..)
|stats count(eval(searchmatch("my test string1"))) as string1 ,count(eval(searchmatch("my test string2"))) as string2, ...
Happy Splunking!

View solution in original post

renjith_nair
Legend

@habisht,

Test this with one of your strings,

index=$index$ sourcetype=$sourcetype$ ("my test string1"  OR "my test string2" OR ..)
|stats count(eval(searchmatch("my test string1"))) as string1 ,count(eval(searchmatch("my test string2"))) as string2, ...
Happy Splunking!

habisht
Explorer

Thanks @renjith.nair it worked.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...