Knowledge Management

summary indexing with sisat distinct count without the list of what is counted

pshumate
Explorer

... |sistats dc(clientip) by host

Returns :
host psrsvd_ct_clientip psrsvd_gc psrsvd_v psrsvd_vm_clientip

Where psrsvd_vm_clientip is the list of the unique ip's. All i need it the count not the detail in the summary index. What is the best way just get the dc(clientip)?

0 Karma
1 Solution

lguinn2
Legend

The sistats distinct count function MUST keep a list of unique ips, as the sistats command is designed to put information into a summary index. When computing the "final" distinct count from a summary index, splunk has to be able to dedup the counts from all the time periods.

When you put data into a summary index, use sistats.

When you get data from a summary index, use stats.

index=summary search_name=the_search_that_put_the_data_in | stats dc(clientip) by host 

should do what you want.

View solution in original post

lguinn2
Legend

The sistats distinct count function MUST keep a list of unique ips, as the sistats command is designed to put information into a summary index. When computing the "final" distinct count from a summary index, splunk has to be able to dedup the counts from all the time periods.

When you put data into a summary index, use sistats.

When you get data from a summary index, use stats.

index=summary search_name=the_search_that_put_the_data_in | stats dc(clientip) by host 

should do what you want.

splunkreal
Motivator

Thanks for the solution!

We can use | sistats values(myfield) as myfield to populate summary index.

* If this helps, please upvote or accept solution 🙂 *
0 Karma

pshumate
Explorer

same thing I came up with. Thanks for the help.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...