Splunk Search

How to use coalesce without hitting search limit

alc2019
New Member

My data is from the same source but I would like to count the number of times a host appears on the event based on two fields criteria. How can I do that without hitting search limit?

index=my_index source=my_source
(source_host=remote* OR dest_host=remote*)
| eval name=coalesce(source_host,dest_host)
| stats count by name

Thank you very much!

0 Karma

woodcock
Esteemed Legend

Try this:

index=my_index source=my_source (source_host=remote* OR dest_host=remote*)
| multireport
[ stats count by source_host]
[ stats count by dest_host ]
| eval name=coalesce(source_host,dest_host)
| fields - *_host
0 Karma

sumanssah
Communicator

minor amendments 🙂

  index=my_index source=my_source (source_host=remote* OR dest_host=remote*)
 | multireport
 [ stats count by source_host]
 [ stats count by dest_host ]
 | eval name=coalesce(source_host,dest_host)
 | fields - *_host
 | stats sum(count) as count by name

woodcock
Esteemed Legend

I agree. Missed it by >that< much.

0 Karma

woodcock
Esteemed Legend

Except you don't need the fields - *_host in that case.

0 Karma

koshyk
Super Champion

The above search seems to be good. it should be constrained by limits.conf only
What type of limit you hitting?

0 Karma

alc2019
New Member

I was trying to apply the answer from this good post, but I cannot make it work.

The coalesce results only one side. I want to count each time a host appears on either source_host or destination_host.

https://answers.splunk.com/answers/524250/how-to-search-for-matches-in-two-different-searche.html

link text

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...