Splunk Search

Summary search count of events

jtm7x2
Explorer

We have our dnsdebuglog turned on and I want to create a summary search of # of events in descending order. Results would look like this:

server 1 700,000

server 2 600,000

server 3 444,000

etc

Currently, we run a scheduled search every 24 hours (at midnight), but I would like to replace that with the summary search.

My attempts so far to make this work have resulted in there being approximately half as many events in the summary search as the scheduled search. Here is what I have:

Scheduled search (we only have 75 servers this applies to):
index="dns" sourcetype="dnsdebuglog" | top host limit=500

Summary search (run hourly):
index=dns sourcetype=dnsdebuglog | sistats count by host

Scheduled summary search:
index=summary search_name=summary_dnsdebuglog | stats count by orig_host | sort -count

What am I doing wrong?

Tags (1)
0 Karma

bmacias84
Champion

I don't really see anything wrong with your seach try adding _time to sistats. Also try using the bucket command, it will allow you create a more accurate hour based summary. Try adding the follwing in your Summary search.

Summary search (run hourly):

index=dns sourcetype=dnsdebuglog | bucket span=1h _time| sistats count by _time, host

Scheduled summary search(I assume summary_dnsdebuglog is the name of your saved search):

index=summary search_name=summary_dnsdebuglog | stats count by orig_host | sort -count
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...