Splunk Search

Distinct Count on Summary Index

sondradotcom
Path Finder

Okay, my summary index looks like this:

sourcetype="blah" | sistats count by email

I'd like to run a query against the index to determine the distinct number of email addresses that appear during a specific time period, as in:

index="summary" search_name="" earliest="-1d@d" latest="0d@d" | stats dc(email)

But it's coming up blank. Any thoughts?

Thanks! -S.

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

You have two choices here. In general, the arguments to stats from a summary index populated by sistats must be exactly the same, so the only valid search (prefix) is:

index="summary" search_name="" earliest="-1d@d" latest="0d@d" | stats count by email

You can find the distinct number of email values by adding stats count to the search, which calculates the number of rows (distinct emails):

index="summary" search_name="" earliest="-1d@d" latest="0d@d" | stats count by email | stats count

Alternately, you could populate the summary index with:

sourcetype="blah" | sistats dc(email)
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...