Splunk Search

How to use stats command with eval function and distinct function on two separate columns?

tushki6391
New Member

Hi everyone,

 

State ID APP _time
INFO ABC Car 19/08/22 19:51
INFO ABC Car 19/08/22 19:52
INFO DEF Car 20/08/22 19:53
INFO ZZZ Book 30/08/22 19:51
INFO ZZZ Book 19/08/22 19:55
WARN ABC Car 19/08/22 19:56
WARN XYZ Car 20/08/22 19:51
WARN ZZZ Book 19/08/22 19:58
WARN ZZZ Book 19/08/22 19:59
ERROR ABC Car 19/08/22 20:00
ERROR ABC Car 19/08/22 20:01
ERROR XYZA Car 30/08/22 19:51

 

I have following data as mentioned in table above, and i have to create a statistical analysis for following requirement

  • Find out count of distinct ID By APP for any given STATE

 

Ex.: 

For State=Info, My Results should be:

APP Count
Car 2
Book 1

 

For State=ERROR, My Results should be:

APP Count
Car 2

 

Currently i am trying like this:

 

 

 

index=testdata
| stats count(eval(searchmatch("*INFO*"))) BY APP

 

 

 

 

But i am Not getting count of  records with Distinct ID. 

 

My Question is: How to use stats command with eval function and distinct function on two separate columns.

Labels (7)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=testdata
| wehre State="INFO"
| stats dc(ID) BY APP
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like this?

| stats dc(ID) as Count by State APP

 

0 Karma

tushki6391
New Member

From my calling application, i have to upfront specify the status type and cannot put in BY clause.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...