Getting Data In

How to chart total number of each hostname that appear in 2 databases from csv files?

lbogle
Contributor

Hi Splunkers,
I have built the following chart extracting hostnames from .csv files that have been exported from both associated databases:

Host DB1 DB2

PCA 1 1

PCB 0 1

PCC 1 1

PCD 0 1

...and so on.
A list of hostnames and then a 1 or 0 to indicate that it's listed in a particular database. What I am trying to do is figure out how to provide totals on how many are in each database. So lets say the reference database 2 has the full number of hostnames. Out of that number how many are also listed in database 1. Like Database1=568 and Database2=900.
Database1 and Database2 are currently listed as the /path/path/path/filename.csv source that the data sits in.
Thanks for any help!

1 Solution

lguinn2
Legend

Try this

your_search_here
| whatever_it_takes_to_get_that_chart
| addtotals
| stats count(eval(DB1==1)) as DB1_Total count(eval(DB2==1)) as DB2_Total  count(eval(total==2)) as InBothDBs

View solution in original post

lguinn2
Legend

Try this

your_search_here
| whatever_it_takes_to_get_that_chart
| addtotals
| stats count(eval(DB1==1)) as DB1_Total count(eval(DB2==1)) as DB2_Total  count(eval(total==2)) as InBothDBs
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...