Dashboards & Visualizations

Trying to get a distinct for this search query

JChapp23
Loves-to-Learn Lots

I'm a new splunk user and I'm trying to figure out how to get a distinct for the search query below.

Any suggestions wo

index=us_gssas_dev_app sourcetype="sql:database" Bot_Name="LoyaltyWaiver" NOT Input_File_Name="" OR Item_Status="Success" OR Item_Status="Exception" OR NOT Item_Status=* OR Item_Status=""
| stats count(eval(match(Input_File_Name,""))) as "Capacity" count(eval(match(Item_Status,"Success$$$$$$$$"))) as "Success" count(eval(match(Item_Status,"Exception$$$$$$$$"))) as "Exception"
count(eval(match(Item_Status," "))) as "WIPF"
count(eval(match(Item_Status, ""))) as "Processed" by Input_File_Name | eval Final_Processed=(Processed - WIPF) | eval WIP=(Capacity - Success - Exception) | eval Success_Percentage=(Success/Capacity)*100 | eval Success_Percentage= round(Success_Percentage, 0) | eval Success_Percentage = Success_Percentage + " %" | table "Input_File_Name" "Capacity" "Success" "Exception" "WIP" "Final_Processed" "Success_Percentage"

Labels (2)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Get a distinct what?  To get a distinct count of something, use the dc function in stats.  To get a list of distinct values, use the values function in stats.

---
If this reply helps you, Karma would be appreciated.
0 Karma

JChapp23
Loves-to-Learn Lots

I'm trying to get a distinct count, but on the search query, but it's not giving me what I'm expecting to see. If I run this search I get total event count of 198, but when I add the dc, values, etc. it only displays 2.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Distinct count of *what*?  Please share the query you're using.

---
If this reply helps you, Karma would be appreciated.
0 Karma

JChapp23
Loves-to-Learn Lots

Below is the query and a distinct on "Input_File_Status" or whatever will display within the query a distinct value.

 

 

index=us_gssas_dev_app sourcetype="sql:database" Bot_Name="LoyaltyWaiver" NOT Input_File_Name="" OR Item_Status="Success" OR Item_Status="Exception" OR NOT Item_Status=* OR Item_Status=""
| stats count(eval(match(Input_File_Name,""))) as "Capacity" count(eval(match(Item_Status,"Success$$$$$$$$"))) as "Success" count(eval(match(Item_Status,"Exception$$$$$$$$"))) as "Exception"
count(eval(match(Item_Status," "))) as "WIPF"
count(eval(match(Item_Status, ""))) as "Processed" by Input_File_Name | eval Final_Processed=(Processed - WIPF) | eval WIP=(Capacity - Success - Exception) | eval Success_Percentage=(Success/Capacity)*100 | eval Success_Percentage= round(Success_Percentage, 0) | eval Success_Percentage = Success_Percentage + " %" | table "Input_File_Name" "Capacity" "Success" "Exception" "WIP" "Final_Processed" "Success_Percentage"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your use of "distinct value" makes me think we have different understandings of what that means.  What do you wish to do with this distinct value?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...