I have an eventtype, but I want to count number of eventtype from nginx access log . then show on dashboard.
eventtype web_spider
:
ua="spider" OR uri="spider" OR ua="bot" OR ua="monitor"
But nginx has a lot of logs , if use index=nginx eventtype="web_spider"|stats count
,search speed will be very slow. Could I use tstats
command to count ?
yes you can use tstats
command but you would need to build a datamodel for that.
Refer this for creating a data model
http://docs.splunk.com/Documentation/Splunk/7.0.1/PivotTutorial/Buildtutorialdatamodel
After creating a datamodel you can use tstats
command
| tstats count FROM datamodel=<datamodel_name> where index=nginx eventtype="web_spider"
If you have a single query that you want it to run faster then you can try report acceleration
as well.
Save a search index=nginx eventtype="web_spider"|stats count
as report and then refer below link to do report acceleration
http://docs.splunk.com/Documentation/Splunk/7.0.2/Report/Acceleratereports
let me know if this helps!
yes you can use tstats
command but you would need to build a datamodel for that.
Refer this for creating a data model
http://docs.splunk.com/Documentation/Splunk/7.0.1/PivotTutorial/Buildtutorialdatamodel
After creating a datamodel you can use tstats
command
| tstats count FROM datamodel=<datamodel_name> where index=nginx eventtype="web_spider"
If you have a single query that you want it to run faster then you can try report acceleration
as well.
Save a search index=nginx eventtype="web_spider"|stats count
as report and then refer below link to do report acceleration
http://docs.splunk.com/Documentation/Splunk/7.0.2/Report/Acceleratereports
let me know if this helps!
thank you very much ~I am a SPLUNK novice
very good answer...