Splunk Search

How to convert this SQL query to splunk search

benazir
Explorer

Hi ,
I have a sql query ,
Count distinct CHNL where MSG_NUM like 'cma%' group by MSG_TM.
Result should get display in hourly basis,

all the CHNL , MSG_NUM , MSG_TM is the column name , which has values . Kindly need your help to convert it .Result should be in hourly basis.

1 Solution

somesoni2
Revered Legend

Try something like,

index=foo sourceltype=bar MSG_NUM=cma* 
| bucket span=1h _time
| stats dc(CHNL) as uniq_channels by _time MSG_TM

or

index=foo sourceltype=bar MSG_NUM=cma* 
| timechart span=1h  dc(CHNL)  by MSG_TM

View solution in original post

somesoni2
Revered Legend

Try something like,

index=foo sourceltype=bar MSG_NUM=cma* 
| bucket span=1h _time
| stats dc(CHNL) as uniq_channels by _time MSG_TM

or

index=foo sourceltype=bar MSG_NUM=cma* 
| timechart span=1h  dc(CHNL)  by MSG_TM

benazir
Explorer

Thank you so much it works perfect with few modification.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Is your data already indexed or are you trying to read a SQL database from Splunk? If the former, see http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/SQLtoSplunk. If the latter, check out the Splunk DB Connect app.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...