Splunk Search

Subsearch help?

msarro
Builder

Hey everyone, simple question.
Is it possible to append or use a subsearch to return a count?
Here is how I'm currently trying to do it, but its blanking all of the other fields as soon as I add the stats command:

sourcetype="AS-CDR" OR sourcetype="XS-CDR" Type!=Interim
|rex field=Local_Call_ID "(?P<Local_Call_ID_Trimmed>\d+)(?=:)"
|rex field=Related_Call_ID "(?P<Related_Call_ID_Trimmed>\d+)(?=:)"
|stats count by Local_Call_ID_Trimmed
|rename count as Related_Calls
|table Start_Time Answer_Time Answer_Indicator Release_Time Termination_Cause_Description Local_Call_ID_Trimmed Related_Call_ID_Trimmed Service_Provider Type User_Number Calling_Number Called_Number Direction User_Time_Zone host Related_Calls
Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

There are two ways to do it. Either use eventstats, or use stats as:

... | stats count as Related_Calls
            first(Start_Time) as Start_Time
            first(Answer_Time) as Answer_Time
            first(Answer_Indicator) as Answer_Indicator
            ...
      by Local_Call_ID_Trimmed

But this assumes that you want to collapse all the other fields by the Local_Call_ID_Trimmed field. It's not clear to me which way is correct for your data.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

There are two ways to do it. Either use eventstats, or use stats as:

... | stats count as Related_Calls
            first(Start_Time) as Start_Time
            first(Answer_Time) as Answer_Time
            first(Answer_Indicator) as Answer_Indicator
            ...
      by Local_Call_ID_Trimmed

But this assumes that you want to collapse all the other fields by the Local_Call_ID_Trimmed field. It's not clear to me which way is correct for your data.

msarro
Builder

Just tried it using eventstats, works like a bell. Thank you! I'll have to play with this a bit more.

0 Karma

msarro
Builder

Basically this is for a search which will run through all calls/events from the past 5 minutes. As each one gets looked at by splunk, I want it to print a table with the details for that individual event. I also want it to show the number of other events where the Local_Call_ID_Trimmed number appears, and place that into a field in the table results. I don't need any of the fields from the related records, just the number of related records.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...