About bmcfar000

bmcfar000 · ‎01-29-2020

The sort command is capping your results to 10000, change your sorts command to | sort 0 dept, -total.

bmcfar000 · ‎08-12-2019

It's a preference, under settings -> spl editor -> Search auto-format

bmcfar000 · ‎05-06-2019

I noticed that stats has an option dedup_splitvals but I can't seem to get it to work correctly.

bmcfar000 · ‎01-09-2019

The goal would be that the results would show me how many devices there were per Version, but not count the duplicate devices. The total for my examples should equal 5 and not 7. the two examples are both in the events that could be found during a 24 hour window and the reason stats dc(device) by version ends up with duplicates. I used your first example, and although it works, it takes a long time (192 seconds for a 4 hour window. I have to stay under 300 seconds for a24 hour window. My current query only takes about 150 seconds, but has the duplicates during version releases. here is my query: base search | fields device, version | stats dc(device) by version

bmcfar000 · ‎01-09-2019

I am working with a large amount of data with over 8 million devices. I am trying to distinct count the number of devices by their version number. Unfortunately, the query is returning duplicates because the devices can be found with multiple versions. For Example: the data may look like this at 9 am... Device: A Version 1 Device: B Version 1 Device: C Version 1 Device: D Version 1 Device: E Version 1 but on a deployment day, by 3 pm, it may look like this: Device: A Version 2 Device: B Version 2 Device: C Version 1 Device: D Version 1 Device: E Version 1 So, my dc(device) by version over 24 hours returns: Version 1 5 Devices Version 2 2 Devices For a total of 7 devices, even though there are actually only 5. Without Using Dedup, how do I eliminate those duplicates?

Posts	5
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎01-09-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Why is my query for DC(Device) by Version returnin...

Re: Limit search to top 10 by specific fields

Re: Why does Using "|" pipe cause 2nd line on sear...

Re: Why is my query for DC(Device) by Version retu...

Re: Why is my query for DC(Device) by Version retu...

Why is my query for DC(Device) by Version returnin...