Splunk Search

Why can't I sum summary data from sistats?

Jason
Motivator

So, I was running ... | sistats count by host, source, sourcetype, field1, field2 and saving it to a summary index.

Then, I wanted to use the summary data to give me lists of hosts, sourcetypes, and sources. No problem, I looked at the summary data and found they were all stored in orig_ variables. (This rewrite only happens with host, source, and sourcetype.)

The problem came when I wanted to create a sum of all "count"s done by the original sistats. It was in a field called psrsvd_gc, but I couldn't use it. It wouldn't play nice and kept saying it was an internal field, or field was not available.

How do I get the sum from summary index data?

1 Solution

Jason
Motivator

You're thinking about it too hard. By using | sistats count by host, source, sourcetype before, just write a search that is index=summary ... | stats count by orig_host, orig_source, orig_sourcetype, field1, field2 and it will just work. The count will be there and you can sum it up from there.

(Remember host, source, and sourcetype are rewritten when summarized, so use the orig_ fields.)

View solution in original post

jdunlea_splunk
Splunk Employee
Splunk Employee

I am having the same problem, but it is not with the metadata fields.

eg: SI Search: .... | sistats count by protocol, action, src_bestmatch

Search ON SI: ..... | stats sum(count) as count by protocol

But again, the "count" from the second search is not available?? What is the solution to this?

0 Karma

peasead
Path Finder

I'm still confused.

I have this to count the number of web categories and how much data was used for each:
... | sistats count by webcategory,bytes

When I run the following to get the amount of data per category:
... | stats sum(bytes) by webcategory
There is nothing displayed for bytes.

When I run:
... | stats count by bytes
I get the count of how many times each bytes total was used but no web category correlation.

If I can't use:
... | stats sum(bytes) by webcategory
how do I know how many bytes were used for each category?

Should I be using:
... | sistats sum(bytes) by webcategory

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Again, you're thinking about it too hard. sistats is supposed to make it easy. If you've used sistats count by x to create the summary data, then you simply use stats count by x to get the results back, not stats sum(count) by x.

Jason
Motivator

You're thinking about it too hard. By using | sistats count by host, source, sourcetype before, just write a search that is index=summary ... | stats count by orig_host, orig_source, orig_sourcetype, field1, field2 and it will just work. The count will be there and you can sum it up from there.

(Remember host, source, and sourcetype are rewritten when summarized, so use the orig_ fields.)

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...