Splunk Search

To Get sum of hosts

xvxt006
Contributor

Hi,

i have a simple query where i am getting response times by host. i want to get the sum of hosts as a filed. I have to use that field in Slack.

host=xxx* sourcetype=yyyyy | stats avg(time) by host

So i have tried to use eventstats but that did not accept host as an argument. Any suggestions please?

Tags (2)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

If you mean a distinct count of hosts:

 host=xxx* sourcetype=yyyyy | stats avg(time) dc(host) by host

However, with the by clause dc(host) will always equal 1 so you'll need something like appendpipe:

 host=xxx* sourcetype=yyyyy | stats avg(time) by host | appendpipe [stats dc(host)]

Maybe you're looking to addcoltotals?

 host=xxx* sourcetype=yyyyy  | stats avg(time) by host | addcoltotals fieldname=avg(time))

If you mean a sum of time by hosts:

 host=xxx* sourcetype=yyyyy | stats avg(time) sum(time) by host

If you meant something else, please explain.

There's also commands called addtotals, appendcols, append, etc. which you may be interested in.

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

If you mean a distinct count of hosts:

 host=xxx* sourcetype=yyyyy | stats avg(time) dc(host) by host

However, with the by clause dc(host) will always equal 1 so you'll need something like appendpipe:

 host=xxx* sourcetype=yyyyy | stats avg(time) by host | appendpipe [stats dc(host)]

Maybe you're looking to addcoltotals?

 host=xxx* sourcetype=yyyyy  | stats avg(time) by host | addcoltotals fieldname=avg(time))

If you mean a sum of time by hosts:

 host=xxx* sourcetype=yyyyy | stats avg(time) sum(time) by host

If you meant something else, please explain.

There's also commands called addtotals, appendcols, append, etc. which you may be interested in.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Hey, you gave me some points, but did I answer the question? If so, can you let us know which search worked?

0 Karma

xvxt006
Contributor

Hi, Thanks for your responses. Those were helpful in finding out different options. i have used appendcols and in combination with eventstats count(eval(match(host, "^x.*"))) as TotalHosts

ppablo
Community Manager
Community Manager

Hi @xvxt006

Glad you were able to find a solution through @jkat54 🙂 Please don't forget to resolve the post by clicking "Accept" directly below his answer. This will make it easier to find for other users with similar questions.

xvxt006
Contributor

Hi, Thank you for the reply. Say there are 4 distinct hosts, i need a filed which shows that count as 4. As i mentioned, i want to use that in Slack.

0 Karma

jkat54
SplunkTrust
SplunkTrust

Ok you want appendcols most likely:

 host=xxx* sourcetype=yyyyy | stats avg(time) by host | appendcols [search host=xxx* sourcetype=yyyyy |stats dc(host)]

Or maybe remove the by clause:

 host=xxx* sourcetype=yyyyy | stats avg(time) dc(host)

Unfortunately I have no idea what is meant by "want to use that in Slack" as I have no experience with "Slack".

0 Karma

jkat54
SplunkTrust
SplunkTrust

This is probably worth a good read too as it goes into differences between chart and stats:

https://answers.splunk.com/answers/32001/difference-between-stats-and-chart.html

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...