Building for the Splunk Platform

How to query only stats using Spunk Java SDK

tuandinh
New Member

Hi Community,

I'm using Splunk Java SDK in my application, this version to be exact:

 

implementation group: 'com.splunk', name: 'splunk', version: '1.6.5.0'

 

In the app, I'm trying to get some stats on a metric from Splunk logs. 
Here's the native search command in Splunk

 

`myapp` "Message of interest" | eventstats min(metricOfInterest) as ft_min max(metricOfInterest) as ft_max avg(metricOfInterest) as ft_avg stdev(metricOfInterest) as ft_stdev | fields ft_min, ft_max, ft_avg, ft_stdev

 

So this query would return a bunch of events and 4 additional fields  ft_min, ft_max, ft_avg, ft_stdev for each event. For the sake of the conversation, let's say there's 200 events matched the search.

In my app, the `SplunkResponse` contains 200 Map<String, Object>, each map represents an event.

What I want is a single entry that contains only `ft_min, ft_max, ft_avg, ft_stdev`. Right now, I can extract it from an event (among those 200),  but having all events is too verbose and unnecessary.  Is this achievable by twisting the query or using a particular SDK API ?

Thanks,
Tuan

 

Labels (2)
0 Karma

VatsalJagani
Champion

@tuandinh - You need to use stats command instead of eventstats.

`myapp` "Message of interest" | stats min(metricOfInterest) as ft_min max(metricOfInterest) as ft_max avg(metricOfInterest) as ft_avg stdev(metricOfInterest) as ft_stdev | fields ft_min, ft_max, ft_avg, ft_stdev

 

I hope this helps!!!

 

0 Karma
Get Updates on the Splunk Community!

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

What's New in Splunk Cloud Platform 9.0.2208?!

Howdy!  We are happy to share the newest updates in Splunk Cloud Platform 9.0.2208! Analysts can benefit ...