summary indexing with sisat distinct count without the list of what is counted

[pshumate]

... |sistats dc(clientip) by host

Returns :
host psrsvd_ct_clientip psrsvd_gc psrsvd_v psrsvd_vm_clientip

Where psrsvd_vm_clientip is the list of the unique ip's. All i need it the count not the detail in the summary index. What is the best way just get the dc(clientip)?

[lguinn2 · Accepted solution]

The sistats distinct count function MUST keep a list of unique ips, as the sistats command is designed to put information into a summary index. When computing the "final" distinct count from a summary index, splunk has to be able to dedup the counts from all the time periods.

When you put data into a summary index, use sistats.

When you get data from a summary index, use stats.

index=summary search_name=the_search_that_put_the_data_in | stats dc(clientip) by host 

should do what you want.

[splunkreal]

Thanks for the solution!

We can use | sistats values(myfield) as myfield to populate summary index.

[pshumate]

same thing I came up with. Thanks for the help.