Splunk Search

How to get count of multiple strings with common index and source type?

habisht
Explorer

I'm trying to create a dashboard which will display pie-charts from different results. For this, I've multiple strings from same index and same source type.
What I've tried:
1. get counts from each and then use in pie-chart with tokens.
2. append required search results and then use them in pie-chart.
Both are OK. but i think there might be some effective way to do this.

like: index=$index$ sourcetype=$sourcetype$ "my test string1" | count AS count1 "my test string2" | count AS count2

0 Karma
1 Solution

renjith_nair
Legend

@habisht,

Test this with one of your strings,

index=$index$ sourcetype=$sourcetype$ ("my test string1"  OR "my test string2" OR ..)
|stats count(eval(searchmatch("my test string1"))) as string1 ,count(eval(searchmatch("my test string2"))) as string2, ...
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@habisht,

Test this with one of your strings,

index=$index$ sourcetype=$sourcetype$ ("my test string1"  OR "my test string2" OR ..)
|stats count(eval(searchmatch("my test string1"))) as string1 ,count(eval(searchmatch("my test string2"))) as string2, ...
---
What goes around comes around. If it helps, hit it with Karma 🙂

habisht
Explorer

Thanks @renjith.nair it worked.

0 Karma
Get Updates on the Splunk Community!

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...

Application management with Targeted Application Install for Victoria Experience

Experience a new era of flexibility in managing your Splunk Cloud Platform apps! With Targeted Application ...