Splunk Search

How do I pass a single value query output to a field?

twh1
Communicator

I have a requirement to print the source count from how many hosts we are collecting.

Expected output: source_count/host_count

index=main | eval host_count=[ search index=main sourcetype=log1 | dedup host | stats dc(host) as Host_Count | return $Host_Count | eval source_count=[ search index=main sourcetype=log1 | dedup source | stats dc(source) as Source_Count | return Source_Count] | eval count=source_count + "/" + host_count
0 Karma

kmaron
Motivator
index=main sourcetype=log1 
| stats dc(host) as Host_Count dc(source) as Source_Count 
| eval count=Source_Count + "/" + Host_Count 
| fields count
0 Karma

twh1
Communicator

Hi @kmaron
I have two different query to fetch the data. I cann't get both count in same stats.

0 Karma

kmaron
Motivator

sorry. they look the same in your example.

Try this instead then

(first base search)
| stats dc(host) as Host_Count 
| append 
    [ search (second base search)
    | stats dc(source) as Source_Count 
    | fields Source_Count] 
| stats values(Host_Count) as Host_Count values(Source_Count) as Source_Count 
| eval count=Source_Count + "/" + Host_Count 
| fields count
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...