Splunk Dev

How to query only stats using Spunk Java SDK

tuandinh
New Member

Hi Community,

I'm using Splunk Java SDK in my application, this version to be exact:

 

implementation group: 'com.splunk', name: 'splunk', version: '1.6.5.0'

 

In the app, I'm trying to get some stats on a metric from Splunk logs. 
Here's the native search command in Splunk

 

`myapp` "Message of interest" | eventstats min(metricOfInterest) as ft_min max(metricOfInterest) as ft_max avg(metricOfInterest) as ft_avg stdev(metricOfInterest) as ft_stdev | fields ft_min, ft_max, ft_avg, ft_stdev

 

So this query would return a bunch of events and 4 additional fields  ft_min, ft_max, ft_avg, ft_stdev for each event. For the sake of the conversation, let's say there's 200 events matched the search.

In my app, the `SplunkResponse` contains 200 Map<String, Object>, each map represents an event.

What I want is a single entry that contains only `ft_min, ft_max, ft_avg, ft_stdev`. Right now, I can extract it from an event (among those 200),  but having all events is too verbose and unnecessary.  Is this achievable by twisting the query or using a particular SDK API ?

Thanks,
Tuan

 

Labels (2)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@tuandinh - You need to use stats command instead of eventstats.

`myapp` "Message of interest" | stats min(metricOfInterest) as ft_min max(metricOfInterest) as ft_max avg(metricOfInterest) as ft_avg stdev(metricOfInterest) as ft_stdev | fields ft_min, ft_max, ft_avg, ft_stdev

 

I hope this helps!!!

 

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...