Splunk Search

how multiple sourcetype stats

nnonm111
Path Finder

There are multiple sourcetypes in index="main".
I'm trying to stats at SOURCETYPE number one and I need a field of sourcetype number two. Is there any way?

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Again, I don't understand 😉

What do you mean "add the src_network="internet0" condition fo www1"? If you don't have this field in the event, you can't filter by it. Do you want to add this field your events?

Maybe show us a sample of your events and a desired output.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Please be a bit more elaborate on what you want to do. We know that you have events of two different sourcetypes in one index. But what do you want to do with them?

Get separate stats for each sourcetype? You can do that with the BY clause in stats or tstats.

Something else? Please be more specific.

 

0 Karma

nnonm111
Path Finder

Ex)
--------------------------------

index="www" Source="www1"
index="www" source="www2"

--------------------------------

My spl:

index="www" source="www1"  status="200"
stats values(src_ip) by dest_ip

--------------------------------

index="www" source="www1"  src_network ="internet0"

--------------------------------

source="www1" does not have an Internet0 field.

I'd like to add the src_network="internet0" condition of www1 to My spl.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...