Splunk Search

search is returning distinct values

email2vamsi
Explorer

Hi Experts,

|search filed1=Enabled OR "Enabled" OR "Disabled" OR Disabled
The above search is returning four rows.
If i try to sum them based on the status ,still its returning four rows.
|stats sum(dc(servers)) by Status

Status---> dc(servers)
Enabled--> 10
Enabled--> 3
Disabled-> 23
Disabled->6

Thank you.

 

 

Labels (1)
0 Karma

email2vamsi
Explorer

@ITWhisperer 

|search filed1=Enabled OR "Enabled" OR "Disabled" OR Disabled

From the above search Enabled returns one row in search,
"Enabled" in double quotes returns second row,
Disabled returns third row and "Disabled" in double quotes returns fourth row.

Field1---> dc(servers)
Enabled--> 10
Enabled--> 3
Disabled-> 23
Disabled->6

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So, your data actually has double quotes sometimes and not others - therefore these are different which is why you get 4 rows - you will have to manipulate the data in some way to get them to be the same e.g. strip the double quotes from the fields which have them.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You're getting something wrong.

In a search with

field1=Enabled OR Enabled

the first "subcondition" is not needed because it will match all occurences of "Enabled" within the whole event (ok, there might be a slightly tricky case with calculated/looked up fields but I'm not sure here - would have to test).

Similar thing goes for

Disabled OR "Disabled"

Since "Disabled" is just one word, you're searching twice for the same term.

So there is no mechanism that "returns four rows" here.

You're not showing us the whole picture.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There doesn't appear to be sufficient information presented to determine what is not working for you. What are the four events returned by the first search?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...