Archive

estdc usage

Communicator

I have this snippet of a search query, and I have a question.

estdc(Purchase_History.Lavender_Paint) as Project1_count

Is estdc looking for the estimated count of the distinct values for Lavender_Paint within Purchase_History?

Thank you for your help

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

The Purchase_History.Lavender_Paint should be a field (hierarchical) in your search result. E.g. if your data is JSON OR XML, it Lavender_Paint field could be child of node Purchase_History.

View solution in original post

SplunkTrust
SplunkTrust

The Purchase_History.Lavender_Paint should be a field (hierarchical) in your search result. E.g. if your data is JSON OR XML, it Lavender_Paint field could be child of node Purchase_History.

View solution in original post

Communicator

Lastly, regarding the count that is being performed, is the count just a number? For example, if there were 75 attacks, would the IDS_Attacks.signature count just display 75, or would it display the name of each attack location?

0 Karma

SplunkTrust
SplunkTrust

It will just display the count (number). The dc(IDS_Attacks.signature) as attack_count will display count of unique values on the field signature, whereas just count will give total number of events (not distinct).

Communicator

OK thank you for your help. I based that question off a query I'm working with and I was wondering if you could help me out with it.

Here is the query:

| tstats `summariesonly` dc(IDS_Attacks.signature) as attack_count,dc(IDS_Attacks.dest) as dest_count,count from datamodel=Intrusion_Detection by IDS_Attacks.src | `drop_dm_object_name("IDS_Attacks")` | sort - count

I'm trying to describe what that search query is doing. I made a description of it, could you let me know if my translation is correct? Here is it:

​Search and return the count of distinct values of the name of the intrusion detected on the client. Renames this count as "Attack Count". Search again and return the count of distinct values of the destination of the attack detected by the intrusion detection system (IDS). Rename this count as "dest count". Perform these counts from the datamodel that has the name "Intrusion Detection". Perform these counts by the source involved in the attacks. Sort the counts by descending order.

Please, any help would be very appreciated. Thank you

0 Karma

SplunkTrust
SplunkTrust

My description will be like this

From the Intrusion Dedection System (IDS) data, calculate the count of distinct attacks (distinct count of IDS_Attacks.signature field), count of distinct destinations and total number attack events, for each Attack source  (IDS_Attacks.src field). Rename the fields to remove prefix and sort in descending order of number of attack events.

Communicator

That really helps thank you a lot!

0 Karma