Get Source Count value

[amoldesai]

Hi,

The following query below returns the output as shown below :

Query:

index="79390-np" sourcetype=np-cache-v2 source="*bp_detail*" |fields deviceId,bpRuleId | join deviceId [search index="79390-np" sourcetype=np-cache-v2 source="*bp_detail*"] | join bpRuleId [search index="79390-np" sourcetype=np-cache-v2 source="*bp_summary*" bpPrimaryTechnology="*"] | eval Month=strftime(_time,"%b %Y") | stats count as "totalExceptions",dc(source) as "sourcecount", dc(deviceId) as "uniquedevices" by Month

Output:

Month totalExceptions sourcecount uniquedevices
Feb 2016 181698 1 4197
Mar 2016 550648 1 4242

Source data for Feb: bp_detail1.gz
Source data or March : bp_detail2.gz, bp_detail3.gz and bp_detail4.gz

In the query above "dc(source) as sourcecount" returns the source count as "1" . I am expecting to some how get the original source count as "3" for March
since there are three source files meeting the criteria(source="*bp_detail*" ) for month of March. I need this count to find an average month wise.Please let me know.

Thanks.

[martin_mueller]

Remove the final |stats and look at the data you're feeding into it. I'm guessing there's only one source value for March, probably because of all those joins. Seeing through what those do for your data is impossible from over here.

For a few alternatives check out https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...

[martin_mueller]

I don't see a point in trying to fix a bunch of joins without knowing the data and requirements for the result - it'll just end in tears.

For example, what original source count are you looking for? You have three searches, so there are three original source counts to choose from?

[amoldesai]

Thanks for looking into it. I am looking to get the source count for bp_detail. It has three source files for March and one for Feb. I have mentioned more about it in my first mail.

Thanks

[amoldesai]

I do know that after all the joins there is one source value for March. But how do I get the original source count . Is there a way to save the source count in a variable before those joins so that I can refer it later for average calculation.Please let me know.

Thanks