Splunk Search

How do you use a variation of the stats command on different fields?

sxddhxrthx
Engager

I have 3 fields: IPAddress, ServiceStatus, BackupStatus.

ServiceStatus field consists of "Services Fine", "Services Stopped", "Services in Error" values.

The backup consists of "Files Uploaded", "Files Upload Pending", "Error in Backup".

I want to get a distinct number of IP addresses present, along with the number of servers having a particular ServiceStatus and BackupStatus.

Example:
Total Servers: 100
Services Fine: 78
Services Stoppped: 14
Services in Error: 8

I could achieve these results in different Searches in the following way:

.. | dedup IPAddress |  stats dc(IPAddress) as TotalServers 
.. | dedup IPAddress |  stats count by ServiceStatus

However, I want to get them in a single search, since I want them to be a part of a single Dashboard Panel.

How can I achieve this?

0 Karma
1 Solution

niketn
Legend

@sxddhxrthx , I hope you have dedup IPAddress because of duplicate records and you want latest ServiceStatus for each IPAddress. Please try out the following search which uses addcoltotal to give the sum of various ServiceStatus as "Total Servers"

<yourCurrentSearch>
| dedup IPAddress 
| stats count by ServiceStatus
| addcoltotal label_field="ServiceStatus" label="Total Servers"
| sort - count

Following is a run anywhere example based on Splunk's _internal index:

index=_internal sourcetype=splunkd 
| stats count by log_level
| addcoltotals labelfield=log_level label="Total Servers"
| sort - count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@sxddhxrthx , I hope you have dedup IPAddress because of duplicate records and you want latest ServiceStatus for each IPAddress. Please try out the following search which uses addcoltotal to give the sum of various ServiceStatus as "Total Servers"

<yourCurrentSearch>
| dedup IPAddress 
| stats count by ServiceStatus
| addcoltotal label_field="ServiceStatus" label="Total Servers"
| sort - count

Following is a run anywhere example based on Splunk's _internal index:

index=_internal sourcetype=splunkd 
| stats count by log_level
| addcoltotals labelfield=log_level label="Total Servers"
| sort - count
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...