Dashboards & Visualizations

Trying to get a distinct for this search query

JChapp23
Loves-to-Learn Lots

I'm a new splunk user and I'm trying to figure out how to get a distinct for the search query below.

Any suggestions wo

index=us_gssas_dev_app sourcetype="sql:database" Bot_Name="LoyaltyWaiver" NOT Input_File_Name="" OR Item_Status="Success" OR Item_Status="Exception" OR NOT Item_Status=* OR Item_Status=""
| stats count(eval(match(Input_File_Name,""))) as "Capacity" count(eval(match(Item_Status,"Success$$$$$$$$"))) as "Success" count(eval(match(Item_Status,"Exception$$$$$$$$"))) as "Exception"
count(eval(match(Item_Status," "))) as "WIPF"
count(eval(match(Item_Status, ""))) as "Processed" by Input_File_Name | eval Final_Processed=(Processed - WIPF) | eval WIP=(Capacity - Success - Exception) | eval Success_Percentage=(Success/Capacity)*100 | eval Success_Percentage= round(Success_Percentage, 0) | eval Success_Percentage = Success_Percentage + " %" | table "Input_File_Name" "Capacity" "Success" "Exception" "WIP" "Final_Processed" "Success_Percentage"

Labels (2)
Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Get a distinct what?  To get a distinct count of something, use the dc function in stats.  To get a list of distinct values, use the values function in stats.

---
If this reply helps you, Karma would be appreciated.
0 Karma

JChapp23
Loves-to-Learn Lots

I'm trying to get a distinct count, but on the search query, but it's not giving me what I'm expecting to see. If I run this search I get total event count of 198, but when I add the dc, values, etc. it only displays 2.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Distinct count of *what*?  Please share the query you're using.

---
If this reply helps you, Karma would be appreciated.
0 Karma

JChapp23
Loves-to-Learn Lots

Below is the query and a distinct on "Input_File_Status" or whatever will display within the query a distinct value.

 

 

index=us_gssas_dev_app sourcetype="sql:database" Bot_Name="LoyaltyWaiver" NOT Input_File_Name="" OR Item_Status="Success" OR Item_Status="Exception" OR NOT Item_Status=* OR Item_Status=""
| stats count(eval(match(Input_File_Name,""))) as "Capacity" count(eval(match(Item_Status,"Success$$$$$$$$"))) as "Success" count(eval(match(Item_Status,"Exception$$$$$$$$"))) as "Exception"
count(eval(match(Item_Status," "))) as "WIPF"
count(eval(match(Item_Status, ""))) as "Processed" by Input_File_Name | eval Final_Processed=(Processed - WIPF) | eval WIP=(Capacity - Success - Exception) | eval Success_Percentage=(Success/Capacity)*100 | eval Success_Percentage= round(Success_Percentage, 0) | eval Success_Percentage = Success_Percentage + " %" | table "Input_File_Name" "Capacity" "Success" "Exception" "WIP" "Final_Processed" "Success_Percentage"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your use of "distinct value" makes me think we have different understandings of what that means.  What do you wish to do with this distinct value?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...