Splunk Search

how multiple sourcetype stats

nnonm111
Path Finder

There are multiple sourcetypes in index="main".
I'm trying to stats at SOURCETYPE number one and I need a field of sourcetype number two. Is there any way?

Labels (2)
0 Karma

PickleRick
Ultra Champion

Again, I don't understand 😉

What do you mean "add the src_network="internet0" condition fo www1"? If you don't have this field in the event, you can't filter by it. Do you want to add this field your events?

Maybe show us a sample of your events and a desired output.

0 Karma

PickleRick
Ultra Champion

Please be a bit more elaborate on what you want to do. We know that you have events of two different sourcetypes in one index. But what do you want to do with them?

Get separate stats for each sourcetype? You can do that with the BY clause in stats or tstats.

Something else? Please be more specific.

 

0 Karma

nnonm111
Path Finder

Ex)
--------------------------------

index="www" Source="www1"
index="www" source="www2"

--------------------------------

My spl:

index="www" source="www1"  status="200"
stats values(src_ip) by dest_ip

--------------------------------

index="www" source="www1"  src_network ="internet0"

--------------------------------

source="www1" does not have an Internet0 field.

I'd like to add the src_network="internet0" condition of www1 to My spl.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...