"XXX targeting service enabled" | stats count as ALL | appendcols [search "exception calling XXX targeting" | stats count as EXC] | eval ratio=ALL/EXC
Search works fine and generates correct ratio when no sampling is made, but if I want to sample, the outer search is fine but the inner runs through the complete event space.
no sample:
ALL: 12182689
EXC: 83363
ratio: 146.140242
1:1000 sample:
ALL: 12108
EXC: 83363
ratio: 0.145244
Easy enough to interpret but it'd be good to know if there's a way to enforce sampling throughout the complete search.
Thanks.
Hi dadkinson,
Not sure if I understand your question correctly, but the stats command is not a good candidate for event sampling. Please refer to the documentation here:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Retrieveasamplesetofevents#Commands_and_fun...
Thanks
Hunter
Hi dadkinson,
Not sure if I understand your question correctly, but the stats command is not a good candidate for event sampling. Please refer to the documentation here:
http://docs.splunk.com/Documentation/Splunk/6.5.0/Search/Retrieveasamplesetofevents#Commands_and_fun...
Thanks
Hunter
Ah yes, I'd forgotten about that note. Thanks.