Splunk Search

Distinct Count on Summary Index

sondradotcom
Path Finder

Okay, my summary index looks like this:

sourcetype="blah" | sistats count by email

I'd like to run a query against the index to determine the distinct number of email addresses that appear during a specific time period, as in:

index="summary" search_name="" earliest="-1d@d" latest="0d@d" | stats dc(email)

But it's coming up blank. Any thoughts?

Thanks! -S.

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

You have two choices here. In general, the arguments to stats from a summary index populated by sistats must be exactly the same, so the only valid search (prefix) is:

index="summary" search_name="" earliest="-1d@d" latest="0d@d" | stats count by email

You can find the distinct number of email values by adding stats count to the search, which calculates the number of rows (distinct emails):

index="summary" search_name="" earliest="-1d@d" latest="0d@d" | stats count by email | stats count

Alternately, you could populate the summary index with:

sourcetype="blah" | sistats dc(email)
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...