Splunk Enterprise

How to count all events in a metric index?

robertlynch2020
Motivator

Hi

I have a metric index that has multiple metric coming into it.

I know i can run a command like this, but i have over 20 different types of metrics and they might change over time. I know i cant run count(*) as you have to specify.

 

 

| mstats count("mx.process.cpu.utilization") as count WHERE "index"="murex_metrics" span=10s | stats count

 

 

 

Then I tried, however, if the data is the same it will only give you a unique not a correct count. 

 

 

| mpreview index=murex_metrics | stats count

 

 

 

So is there any command that will give me the stats count of a metric index quickly?

 

Labels (1)
0 Karma
1 Solution

Siddharth
Path Finder

Use this | mstats count(_value) as total where metric_name = "*"  AND  Index = metric_index span=you_want 


To understand what is count(_value) will do please read this 

Syntax:
 count(_value) | <function>(_value) [AS <string>] WHERE metric_name=<metric_name>Description: Specify a basic count of the _value field or a function on the _value field. The _value field uses a specific format to store the numeric value of the metric. You can specify one or more functions. Y


https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Mstats check the last line of this page they have given the example of what you are looking for

View solution in original post

0 Karma

Siddharth
Path Finder

Use this | mstats count(_value) as total where metric_name = "*"  AND  Index = metric_index span=you_want 


To understand what is count(_value) will do please read this 

Syntax:
 count(_value) | <function>(_value) [AS <string>] WHERE metric_name=<metric_name>Description: Specify a basic count of the _value field or a function on the _value field. The _value field uses a specific format to store the numeric value of the metric. You can specify one or more functions. Y


https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchReference/Mstats check the last line of this page they have given the example of what you are looking for

0 Karma

robertlynch2020
Motivator

Hi

That worked

| mstats count(_value) as total where metric_name = "*" AND index = murex_metrics

Cheers

 

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...