Splunk Search

Finding total number for OOID

splunkman341
Communicator

Hi all,

I currently have a search that I need a little tweaking to get something else that I want.

So the current search :

index=test sourcetype=test "OOID Folder workspace" | lookup client_ooid_to_name OOID OUTPUT clientName | eval Client=clientName . "(" . OOID . ")" | chart count by Client action | addtotals | sort 5 -Total

Looks up the five most active OOIDs by number, maps them to a name which I imported a lookup table for, then displays the count of actions for each OOID.

What I want to do now is to just get the total number of OOIDS per day, as opposed to finding the count for each one.

Can anyone lend a hand?

Thanks in advance for your responses.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

How about this

index=test sourcetype=test "OOID Folder workspace" | timechart span=1d count(OOID) as OOID_Count

OR

index=test sourcetype=test "OOID Folder workspace" | lookup client_ooid_to_name OOID OUTPUT clientName | eval Client=clientName . "(" . OOID . ")"| timechart span=1d count(Client) as OOID_Count

View solution in original post

splunkman341
Communicator

Thanks for your responses guys! All work like a dream!

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps something like this?

index=test sourcetype=test "OOID Folder workspace" | stats dc(OOID) | ...

or maybe

index=test sourcetype=test "OOID Folder workspace" | timechart span=1d dc(OOID) | ...
---
If this reply helps you, Karma would be appreciated.

somesoni2
Revered Legend

How about this

index=test sourcetype=test "OOID Folder workspace" | timechart span=1d count(OOID) as OOID_Count

OR

index=test sourcetype=test "OOID Folder workspace" | lookup client_ooid_to_name OOID OUTPUT clientName | eval Client=clientName . "(" . OOID . ")"| timechart span=1d count(Client) as OOID_Count

landen99
Motivator

Count gives the number of events with the ooid field. DC is the correct function.

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...