Splunk Search

Distinct count limit workaround

nbharadwaj
Path Finder

So I use the following workaround to get over the 100k hurdle with distinct_count(field1)

....| stats count by field1 | stats count

However I need to include other metrics (field2, field3) in the same search. For example

....| stats avg(field2) avg(field3)

How can I compute all the three metrics in one search?

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

I believe that limit has been removed as of version 4.2, so I think if you can upgrade, you can get around it easily that way.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I believe that limit has been removed as of version 4.2, so I think if you can upgrade, you can get around it easily that way.

0 Karma

sideview
SplunkTrust
SplunkTrust

It will make it a bit less efficient but eventstats can make a first pass for you.

Eventstats avg(field2) as f2 avg(field3) as f3 | stats first(f2) as f2 first(f3) as f3 count by field1 | stats count first(f2) as "avg field2" first(f3) as "avg field3"  
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...