I'm a new splunk user and I'm trying to figure out how to get a distinct for the search query below.
Any suggestions wo
index=us_gssas_dev_app sourcetype="sql:database" Bot_Name="LoyaltyWaiver" NOT Input_File_Name="" OR Item_Status="Success" OR Item_Status="Exception" OR NOT Item_Status=* OR Item_Status=""
| stats count(eval(match(Input_File_Name,""))) as "Capacity" count(eval(match(Item_Status,"Success$$$$$$$$"))) as "Success" count(eval(match(Item_Status,"Exception$$$$$$$$"))) as "Exception"
count(eval(match(Item_Status," "))) as "WIPF"
count(eval(match(Item_Status, ""))) as "Processed" by Input_File_Name | eval Final_Processed=(Processed - WIPF) | eval WIP=(Capacity - Success - Exception) | eval Success_Percentage=(Success/Capacity)*100 | eval Success_Percentage= round(Success_Percentage, 0) | eval Success_Percentage = Success_Percentage + " %" | table "Input_File_Name" "Capacity" "Success" "Exception" "WIP" "Final_Processed" "Success_Percentage"
Get a distinct what? To get a distinct count of something, use the dc function in stats. To get a list of distinct values, use the values function in stats.
I'm trying to get a distinct count, but on the search query, but it's not giving me what I'm expecting to see. If I run this search I get total event count of 198, but when I add the dc, values, etc. it only displays 2.
Distinct count of *what*? Please share the query you're using.
Below is the query and a distinct on "Input_File_Status" or whatever will display within the query a distinct value.
index=us_gssas_dev_app sourcetype="sql:database" Bot_Name="LoyaltyWaiver" NOT Input_File_Name="" OR Item_Status="Success" OR Item_Status="Exception" OR NOT Item_Status=* OR Item_Status=""
| stats count(eval(match(Input_File_Name,""))) as "Capacity" count(eval(match(Item_Status,"Success$$$$$$$$"))) as "Success" count(eval(match(Item_Status,"Exception$$$$$$$$"))) as "Exception"
count(eval(match(Item_Status," "))) as "WIPF"
count(eval(match(Item_Status, ""))) as "Processed" by Input_File_Name | eval Final_Processed=(Processed - WIPF) | eval WIP=(Capacity - Success - Exception) | eval Success_Percentage=(Success/Capacity)*100 | eval Success_Percentage= round(Success_Percentage, 0) | eval Success_Percentage = Success_Percentage + " %" | table "Input_File_Name" "Capacity" "Success" "Exception" "WIP" "Final_Processed" "Success_Percentage"
Your use of "distinct value" makes me think we have different understandings of what that means. What do you wish to do with this distinct value?