Splunk Search

search is returning distinct values

email2vamsi
Explorer

Hi Experts,

|search filed1=Enabled OR "Enabled" OR "Disabled" OR Disabled
The above search is returning four rows.
If i try to sum them based on the status ,still its returning four rows.
|stats sum(dc(servers)) by Status

Status---> dc(servers)
Enabled--> 10
Enabled--> 3
Disabled-> 23
Disabled->6

Thank you.

 

 

Labels (1)
0 Karma

email2vamsi
Explorer

@ITWhisperer 

|search filed1=Enabled OR "Enabled" OR "Disabled" OR Disabled

From the above search Enabled returns one row in search,
"Enabled" in double quotes returns second row,
Disabled returns third row and "Disabled" in double quotes returns fourth row.

Field1---> dc(servers)
Enabled--> 10
Enabled--> 3
Disabled-> 23
Disabled->6

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

So, your data actually has double quotes sometimes and not others - therefore these are different which is why you get 4 rows - you will have to manipulate the data in some way to get them to be the same e.g. strip the double quotes from the fields which have them.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You're getting something wrong.

In a search with

field1=Enabled OR Enabled

the first "subcondition" is not needed because it will match all occurences of "Enabled" within the whole event (ok, there might be a slightly tricky case with calculated/looked up fields but I'm not sure here - would have to test).

Similar thing goes for

Disabled OR "Disabled"

Since "Disabled" is just one word, you're searching twice for the same term.

So there is no mechanism that "returns four rows" here.

You're not showing us the whole picture.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There doesn't appear to be sufficient information presented to determine what is not working for you. What are the four events returned by the first search?

0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...