Splunk Search

eventstats distinct values

kasimbekur
Explorer

I have used below query to get distinct values:

stats values(gitRepo) AS serviceName BY buildNum

This gives correct values. Problem is I am not getting value for other fields. If I used eventstats all values are coming in the table output but it is getting wrong data.

eventstats values(gitRepo) AS serviceName BY buildNum

How do I fix this?

0 Karma
1 Solution

493669
Super Champion

Try this:

   ...| stats values(*) as * by buildNum

It will give all fields unique values by buildNum

View solution in original post

493669
Super Champion

Try this:

   ...| stats values(*) as * by buildNum

It will give all fields unique values by buildNum

kasimbekur
Explorer

awesome, it worked. Can you explain more about it? so that we can understand concept better. Also let me know Splunk reference documents for above solution.

0 Karma

493669
Super Champion

here * denotes wildcard
stats values(*) as * will calculate all fields unique values
have a look at http://docs.splunk.com/Documentation/Splunk/7.0.3/SearchReference/Stats
stats - Calculates aggregate statistics over the results set, such as average, count, and sum. This is similar to SQL aggregation. If stats is used without a by clause only one row is returned, which is the aggregation over the entire incoming result set. If you use a by clause one row is returned for each distinct value specified in the by clause.
eventstats - Generate summary statistics of all existing fields in your search results and saves those statistics in to new fields. The eventstats command is similar to the stats command. The difference is that with the eventstats command aggregation results are added inline to each event and added only if the aggregation is pertinent to that event.
to better understand difference between stats and eventstats have a look at answer
https://answers.splunk.com/answers/139534/what-are-the-calculated-differences-between-stats-and-even...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...