Dashboards & Visualizations

How can I have a Search return multiple Stats and a Total?

TDeFrank
Observer

I have an issue which seems to be simple but after 2 days I'm still struggling.  I am attempting to have one search return the number of Logins for a large set of Hosts for both Windows and Linux.  I have successfully figured out each Search which will give me the numbers I want, however it only ever returns 1 Stat row.  I want to be able to show both numbers plus a total.  Here is my search altered slightly for security...

index=windows [ inputlookup hosts.csv |  fields host] EventCode = 4627
|  stats count as winlogins
| appendcols
    [search index=linux [ inputlookup hosts.csv |  fields host]  type=login
|  stats count as linuxlogins]
| addtotals

What I get is each value and a Total but it only has 1 Statistics row so I am unsure how to create a useful Visualization(Report) which will ultimately be placed on a Dashboard.  How can I get 1 search to return all 3 values as seperate Statistics so I can post a Report on a Dashboard?

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Have you tried something like

( index=windows EventCode = 4627 ) OR ( index=linux type=login ) [ inputlookup hosts.csv |  fields host]
| stats count by index
| addtotals
0 Karma

TDeFrank
Observer

Yes I've tried using or before with no success, your query below returns 0 Events so that will not work either.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry I missed a pipe

( index=windows EventCode = 4627 ) OR ( index=linux type=login ) [ | inputlookup hosts.csv |  fields host]
| stats count by index
| addtotals
0 Karma

TDeFrank
Observer

I tried it with the additional pipe - still 0 events are returned.  I've been testing today and It seems that Splunk has an issue with OR if you are using a Lookup - no matter the syntax.  I even tried this way and it still returns 0 events...

(index=windows [ inputlookup hosts.csv |  fields host] EventCode = 4627) or (index=linux [ inputlookup hosts.csv |  fields host]  type=login)

Running each inside the ( ) individually works just fine, but using OR returns 0 events.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So, do you get the counts you need without the inputlookup?

0 Karma

TDeFrank
Observer

Holy Smokes - so the issue with the OR was I did not have it all caps - I thought an OR was an or but not here - cryptic...

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Same goes for AND by the way - easy one to miss - been there, done that!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!