Splunk Search

how multiple sourcetype stats

nnonm111
Path Finder

There are multiple sourcetypes in index="main".
I'm trying to stats at SOURCETYPE number one and I need a field of sourcetype number two. Is there any way?

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Again, I don't understand :winking_face:

What do you mean "add the src_network="internet0" condition fo www1"? If you don't have this field in the event, you can't filter by it. Do you want to add this field your events?

Maybe show us a sample of your events and a desired output.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Please be a bit more elaborate on what you want to do. We know that you have events of two different sourcetypes in one index. But what do you want to do with them?

Get separate stats for each sourcetype? You can do that with the BY clause in stats or tstats.

Something else? Please be more specific.

 

0 Karma

nnonm111
Path Finder

Ex)
--------------------------------

index="www" Source="www1"
index="www" source="www2"

--------------------------------

My spl:

index="www" source="www1"  status="200"
stats values(src_ip) by dest_ip

--------------------------------

index="www" source="www1"  src_network ="internet0"

--------------------------------

source="www1" does not have an Internet0 field.

I'd like to add the src_network="internet0" condition of www1 to My spl.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...