Splunk Search

How to count the events from domain controller server hosts per hour using tstats?

landen99
Motivator

I want to count the events from dc server hosts by hour using tstats:

| tstats count where host="srv*dc*" by host GROUPBY _time span=1h

I know that tstats is fast because it uses tsidx files with summary field data about the events for the indexed fields: _time, host, index, etc. without opening each event and looking at the _raw field. I am interested in learning how to get tstats to do this job instead of using index=_internal or | metadata so that I can understand how stats works and where it performs best.

The results of the search above are: No results found. This is true with the where clause removed as well. How can I quickly generate an hourly count of dc hosts using tstats?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi landen99,

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Tstats it will tell you this:

tstats [prestats=<bool>] [local=<bool>] [append=<bool>] [summariesonly=<bool>] [allow_old_summaries=<bool>] [chunk_size=<unsigned int>] <stats-func> [ FROM ( <namespace> | sid=<tscollect-job-id> | datamodel=<datamodel-name> )] [WHERE <search-query>] [( by | GROUPBY ) <field-list> [span=<timespan>] ]

the importent part here is this:
( by | GROUPBY )

So you either can use by OR GROUPBYbut not both in one search. Try this

| tstats count where host="srv*dc*" GROUPBY _time span=1h

or

| tstats count where host="srv*dc*" by _time span=1h

hope this helps ...

cheers, MuS

View solution in original post

MuS
SplunkTrust
SplunkTrust

Hi landen99,

take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/SearchReference/Tstats it will tell you this:

tstats [prestats=<bool>] [local=<bool>] [append=<bool>] [summariesonly=<bool>] [allow_old_summaries=<bool>] [chunk_size=<unsigned int>] <stats-func> [ FROM ( <namespace> | sid=<tscollect-job-id> | datamodel=<datamodel-name> )] [WHERE <search-query>] [( by | GROUPBY ) <field-list> [span=<timespan>] ]

the importent part here is this:
( by | GROUPBY )

So you either can use by OR GROUPBYbut not both in one search. Try this

| tstats count where host="srv*dc*" GROUPBY _time span=1h

or

| tstats count where host="srv*dc*" by _time span=1h

hope this helps ...

cheers, MuS

gaurav_maniar
Builder

Hi MuS,

I have similar query, can you please check below question,
https://answers.splunk.com/answers/770370/how-to-get-tstats-results-independent-of-time-rang.html

0 Karma

MuS
SplunkTrust
SplunkTrust

This will:

| tstats count where host="srv*dc*" by host, _time span=1h

landen99
Motivator

perfect. thank you.

0 Karma

landen99
Motivator

People should keep in mind that the where clause is for the search query. In many cases, an index needs to be specified, just as with any search query.

| tstats count where index=myindex host="srv*dc*" by host _time span=1h
0 Karma

landen99
Motivator

Will that generate hourly counts for each host?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...