Splunk Search

Stuck in writing complex query

Pathik
Path Finder

I want to get below in single query

1. dc of field1 overall

2. dc of field2 by field1

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
| eventstats dc(field1) as dc_field1
| stats dc(field2) as dc_field2, max(dc_field1) by field1
---
If this reply helps you, Karma would be appreciated.

Pathik
Path Finder

exactly the way I wanted... thanks a ton

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Pathik
Path Finder

I want to get below in single query

1. dc of field1 overall

2. dc of field2 by field1

0 Karma
Get Updates on the Splunk Community!

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...

Splunk With AppDynamics - Meet the New IT (And Engineering) Couple

Wednesday, November 20, 2024  |  10AM PT / 1PM ET Register Now Join us in this session to learn all about ...