Splunk Search

How to use stats command with eval function and distinct function on two separate columns?

tushki6391
New Member

Hi everyone,

 

State ID APP _time
INFO ABC Car 19/08/22 19:51
INFO ABC Car 19/08/22 19:52
INFO DEF Car 20/08/22 19:53
INFO ZZZ Book 30/08/22 19:51
INFO ZZZ Book 19/08/22 19:55
WARN ABC Car 19/08/22 19:56
WARN XYZ Car 20/08/22 19:51
WARN ZZZ Book 19/08/22 19:58
WARN ZZZ Book 19/08/22 19:59
ERROR ABC Car 19/08/22 20:00
ERROR ABC Car 19/08/22 20:01
ERROR XYZA Car 30/08/22 19:51

 

I have following data as mentioned in table above, and i have to create a statistical analysis for following requirement

  • Find out count of distinct ID By APP for any given STATE

 

Ex.: 

For State=Info, My Results should be:

APP Count
Car 2
Book 1

 

For State=ERROR, My Results should be:

APP Count
Car 2

 

Currently i am trying like this:

 

 

 

index=testdata
| stats count(eval(searchmatch("*INFO*"))) BY APP

 

 

 

 

But i am Not getting count of  records with Distinct ID. 

 

My Question is: How to use stats command with eval function and distinct function on two separate columns.

Labels (7)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=testdata
| wehre State="INFO"
| stats dc(ID) BY APP
0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like this?

| stats dc(ID) as Count by State APP

 

0 Karma

tushki6391
New Member

From my calling application, i have to upfront specify the status type and cannot put in BY clause.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...