Splunk Search

Why am I receiving fewer events when using rename command in Splunk?

vjsplunk
Loves-to-Learn Lots

I am getting fewer events when using rename command in splunk. ( Compared to the search where I haven't used rename). What could be the reason behind this?

Labels (1)
0 Karma

vjsplunk
Loves-to-Learn Lots

Without rename:

index="A"  sourcetype="B"
| stats values(project_name2), count(linecount) by pod
| sort - count(linecount) | head 10

With rename:

index="A"  sourcetype="B"

| stats values(project_name2) as project count(linecount) as lines by pod
| sort - count(linecount) | head 10

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vjsplunk,

the reason is that in the second case you don't have more ths field "count(linecount)" but the field "lines", so when you sort you have few events, please try this:

index="A"  sourcetype="B"
| stats values(project_name2) AS project count(linecount) AS lines BY pod
| sort -lines 
| head 10

Ciao.

Giuseppe

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @vjsplunk,

could you share your searches (with and without rename)?

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...