Splunk Enterprise

Can I run the below mstats command as 1 command?

robertlynch2020
Influencer

hi

Can I make the below mstats into one SPL? Below there are 2.

I am pulling data from the same metric. I have a "where" in one.  

 

 

| mstats sum("mx.http.server.requests") as total WHERE "index"="murex_metrics" mx.env="feature/monitoring/nfr/new-log-metrics-19"
| appendcols 
    [ mstats sum("mx.http.server.requests") as declined WHERE "index"="murex_metrics" mx.env="feature/monitoring/nfr/new-log-metrics-19" status.code>=400
	 | appendpipe 
        [ stats count 
        | eval declined=0 
        | where count=0 
        | table declined ]] 
| eval percent_declined=100 * declined / total 
| table percent_declined

 

 

I looked at this question and I don't think I can use "stats style eval aggr functions" 

 

| stats count(eval(ip=="37.25.139.34")) 

 

https://community.splunk.com/t5/Splunk-Search/How-to-use-eval-with-mstats/td-p/563751

So perhaps I need to run 2 mstats, I was hoping I could just run 1. However i think it is not possible for what i am trying to do.

 

Rob

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...