Getting this informational message when running "stats count" commands:
This search uses deprecated 'stats' command syntax. This syntax implicitly translates '<function>' or '<function>()' to '<function>(*)', except for cases where the function is 'count'. Use '<function>(*)' instead.
I don't understand it. What am I doing wrong and what should I be doing instead? A sample of the stats command generating the message above:
| stats sparkline count(Destination) AS sessions by Destination_URL, Destination_userID
Thanks!
Turns out it's a bug - the "deprecated syntax" notification is not supposed to happen - thanks @mattness for the post!
"Turns out this particular example is a bug. Splunk 8.0.0 through 8.0.6 generates this "info message" when you use sparkline without an argument (such as sparkline(count) or sparkline(count(cpu)). This isn't supposed to happen. The bug is fixed in upcoming versions of Splunk."
The sparkline argument should be a function, perhaps
| stats sparkline(count(Destination)) AS sessions by Destination_URL, Destination_userID
That removes the session count field though. This one:
So add it back in.
| stats sparkline(count(Destination)), count(Destination)) AS sessions by Destination_URL, Destination_userID
I did. 🙂 But doesn't that means "stats" is then run twice for the same dataset, thus unnecessarily increasing the "cost" of the search? (And somewhat clogging it, making it just a teeny bit less readable?)
@richgalloway just in case you have the bandwidth for a follow up question...
Here is the sample search in "Add sparklines to search results" Splunk KB article for 8.0.5 (latest) release:
index=_internal | chart sparkline count by sourcetype
It produces the same dreaded "deprecated syntax" notification in my 8.04.1 instance.
Questions:
> That command works without error on my 8.0.4 instance.
This gives me the green "deprecated syntax" informational message in 8.04.1, 8.05:
index=_internal
| chart sparkline count by sourcetype
> How do you know which syntax is more performant? Does the Job Inspector show a noticeable difference?
About 10-20% faster for the "deprecated" one vs. the one you came up with, with two "count" functions.
| stats sparkline(count(Destination)), count(Destination))
Turns out it's a bug - the "deprecated syntax" notification is not supposed to happen - thanks @mattness for the post!
"Turns out this particular example is a bug. Splunk 8.0.0 through 8.0.6 generates this "info message" when you use sparkline without an argument (such as sparkline(count) or sparkline(count(cpu)). This isn't supposed to happen. The bug is fixed in upcoming versions of Splunk."
index=_internal | chart sparkline count by sourcetype
https://docs.splunk.com/Documentation/Splunk/8.0.5/Search/Addsparklinestosearchresults
Typo on my part (grabbed the wrong SPL from the docs). Corrected. The solution you're proposing is the one with the problem and the one I have questions about.