Splunk Search

Why can't I sum summary data from sistats?

Jason
Motivator

So, I was running ... | sistats count by host, source, sourcetype, field1, field2 and saving it to a summary index.

Then, I wanted to use the summary data to give me lists of hosts, sourcetypes, and sources. No problem, I looked at the summary data and found they were all stored in orig_ variables. (This rewrite only happens with host, source, and sourcetype.)

The problem came when I wanted to create a sum of all "count"s done by the original sistats. It was in a field called psrsvd_gc, but I couldn't use it. It wouldn't play nice and kept saying it was an internal field, or field was not available.

How do I get the sum from summary index data?

1 Solution

Jason
Motivator

You're thinking about it too hard. By using | sistats count by host, source, sourcetype before, just write a search that is index=summary ... | stats count by orig_host, orig_source, orig_sourcetype, field1, field2 and it will just work. The count will be there and you can sum it up from there.

(Remember host, source, and sourcetype are rewritten when summarized, so use the orig_ fields.)

View solution in original post

jdunlea_splunk
Splunk Employee
Splunk Employee

I am having the same problem, but it is not with the metadata fields.

eg: SI Search: .... | sistats count by protocol, action, src_bestmatch

Search ON SI: ..... | stats sum(count) as count by protocol

But again, the "count" from the second search is not available?? What is the solution to this?

0 Karma

peasead
Path Finder

I'm still confused.

I have this to count the number of web categories and how much data was used for each:
... | sistats count by webcategory,bytes

When I run the following to get the amount of data per category:
... | stats sum(bytes) by webcategory
There is nothing displayed for bytes.

When I run:
... | stats count by bytes
I get the count of how many times each bytes total was used but no web category correlation.

If I can't use:
... | stats sum(bytes) by webcategory
how do I know how many bytes were used for each category?

Should I be using:
... | sistats sum(bytes) by webcategory

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

Again, you're thinking about it too hard. sistats is supposed to make it easy. If you've used sistats count by x to create the summary data, then you simply use stats count by x to get the results back, not stats sum(count) by x.

Jason
Motivator

You're thinking about it too hard. By using | sistats count by host, source, sourcetype before, just write a search that is index=summary ... | stats count by orig_host, orig_source, orig_sourcetype, field1, field2 and it will just work. The count will be there and you can sum it up from there.

(Remember host, source, and sourcetype are rewritten when summarized, so use the orig_ fields.)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...