Splunk Search

distinct count not working on summary index (sistats)

loganramirez
Path Finder

Splunk Enterprise 9.0.6 and building a summary index of sourcenumbers (count) and distinct destinations called (dc(destinationnumber))

When i run this:

...
| stats count dc(destinationnumber) by sourcenumber


I get something like

sourcenumber,count,dc(destinationnumber)
+15551234567,10,8

indicating it called 10 times to 8 different numbers.
adsf
perfect.

But with this:

...
| sistats count dc(destinationnumber) by sourcenumber

 

i get:

psrsvd_ct_destinationnumber,psrsvd_gc,psrsvd_v, psrsvd_vm_destinationnumber
10,10,1,+19991234567;2,+18881234567;2,+17771234567;1,+15551234567;1 (etc)

Found no clear help in the sistats page and other posts like this one it seems to work (though older posts and not using count)

Best guess is that vm column 'preserves' the details, but idk why dc() isn't working like I expect.

Labels (1)
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...