Knowledge Management

Correct count of events

strawberry28
Explorer

source="http:Emerson_P1CDN"
| spath host
| spath client_ip
| spath status_code | where status_code=200
| spath referer | where referer=""
| spath path | search path NOT ("*wcsextendedsearch" OR "*EmersonSKUListingView" OR "*EmersonProductListingView" OR "*CartRefreshStatusJSON" OR "*PriceAjaxView" OR "*AjaxSerialNumber" OR "*UnsupportedBrowserErrorView" OR "*LogonForm"OR "*MiniCart" OR "*MiniShopCartDisplayView" OR "*AnalyticsPageView" OR "*AjaxAccountLinkDisplay" OR "*.css" OR "*.js" OR "*.woff2" OR "*.woff" OR "*.gif" OR "*.png" OR "*.jpg" OR "*.ico" OR "*.pdf" OR "*.html" OR "*.txt" OR "*.xml" OR "*/ClickInfo" OR "*thumb")
| bin _time span=1m
| stats count by _time,host,path,client_ip | where count >= 100 | sort - count

Does the query at the top is correct?, because we want to count the total events of _time,host,path and client_ip per minute

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Yes, stats will count the events which match the unique combinations of those fields

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You might want to consider

| spath referer | where referer="" OR isnull(referer)
0 Karma

strawberry28
Explorer

I will, but is it looks good? does the stats count. count the events?
thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, stats will count the events which match the unique combinations of those fields

0 Karma

strawberry28
Explorer

Thank you so much!

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...