Splunk Search

Splunk JavaScript API getting stats in a search

najarvis
Engager

I am using the Splunk JavaScript API to create a dashboard to aggregate data. One of my searches that I want literally just sums up the total of a given field using

search index=[index] source="[path]" | stats sum("Val_in rep_cur") as Total

Even though this gives the correct number on the website, it is in the 'statistics' tab. When I run this same search in the JavaScript API, the results object is just empty. How can I get the sum of a field in the JavaScript API?

EDIT:
So it looks like if I replace stats with eventstats it will add a new field to each event. However, I am still not getting any results in the API.

My new search is

search index=[index] source="[path]" | eventstats sum("Val_in rep_cur") as Total | dedup Total | fields Total
0 Karma
1 Solution

najarvis
Engager

Somehow removing the source ended up fixing the problem. The answer I was looking for was changing stats to eventstats. I only had two backslashes in my search, but because it was in a string in JavaScript it needed 4.

source="G:\\AutoIndex\\spending\\Catalog Report - 8758 Devices.csv"

should've been

source="G:\\\\AutoIndex\\\\spending\\\\Catalog Report - 8758 Devices.csv"

View solution in original post

0 Karma

najarvis
Engager

Somehow removing the source ended up fixing the problem. The answer I was looking for was changing stats to eventstats. I only had two backslashes in my search, but because it was in a string in JavaScript it needed 4.

source="G:\\AutoIndex\\spending\\Catalog Report - 8758 Devices.csv"

should've been

source="G:\\\\AutoIndex\\\\spending\\\\Catalog Report - 8758 Devices.csv"
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...