Hello, How can I improve on my Splunk query so that only one event is counted over a 30-day span where we have 500,000,000 events matched? This is the query I have so far: | tstats count WHE...
See more...
Hello, How can I improve on my Splunk query so that only one event is counted over a 30-day span where we have 500,000,000 events matched? This is the query I have so far: | tstats count WHERE (index=<my_index> sourcetype=json_data earliest=-30d latest=-0h) BY _time span=1mon, host, address, server This query returns approximately 600,000,000 events, but I only need to count just one of these unique events at the host-level. Since I'm using the tstats command first to retrieve data, I made sure that indeces exist on _time, host, address, and server. My problem here is that Splunk first retreives all of the matching events and then it removes the duplicates. Is there a way to just retreive unique events by host, address, and server? For example, a host could have the following events over the past 30 days: _time host address server 2021-07-13 12:55:08 testenv1 10.10.10.10 store1 2021-07-13 12:55:08 testenv1 10.10.10.10 store1 2021-07-13 12:55:08 testenv1 10.10.10.10 store1 2021-07-13 12:55:08 testenv2 10.10.10.11 store2 2021-07-13 12:55:08 testenv2 10.10.10.11 store2 2021-07-13 12:55:08 testenv2 10.10.10.11 store2 And I want my query to do this: _time host address server 2021-07 testenv1 10.10.10.10 store1 2021-07 testenv2 10.10.10.11 store2 This is just a sample of my data. In several cases, we have unique hosts that repeat 20,000 times over a hour time span. I need my Splunk query to display this record just once, without having to retreive all other 20,000 events. I also tried to use disctinct_counts like this, but this still retrieves all of the duplicated events under the Events tab: | tstats distinct_count WHERE (index=<my_index> sourcetype=json_data earliest=-30d latest=-0h) BY _time span=1mon, host, address, server I've browsed multiple Splunk threads and I'm just stumped. Thank you.