Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- summary indexing with sisat distinct count without...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
... |sistats dc(clientip) by host
Returns :
host psrsvd_ct_clientip psrsvd_gc psrsvd_v psrsvd_vm_clientip
Where psrsvd_vm_clientip is the list of the unique ip's. All i need it the count not the detail in the summary index. What is the best way just get the dc(clientip)?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The sistats distinct count function MUST keep a list of unique ips, as the sistats command is designed to put information into a summary index. When computing the "final" distinct count from a summary index, splunk has to be able to dedup the counts from all the time periods.
When you put data into a summary index, use sistats.
When you get data from a summary index, use stats.
index=summary search_name=the_search_that_put_the_data_in | stats dc(clientip) by host
should do what you want.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The sistats distinct count function MUST keep a list of unique ips, as the sistats command is designed to put information into a summary index. When computing the "final" distinct count from a summary index, splunk has to be able to dedup the counts from all the time periods.
When you put data into a summary index, use sistats.
When you get data from a summary index, use stats.
index=summary search_name=the_search_that_put_the_data_in | stats dc(clientip) by host
should do what you want.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the solution!
We can use | sistats values(myfield) as myfield to populate summary index.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
same thing I came up with. Thanks for the help.
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...
