Splunk Search

How to use coalesce without hitting search limit

alc2019
New Member

My data is from the same source but I would like to count the number of times a host appears on the event based on two fields criteria. How can I do that without hitting search limit?

index=my_index source=my_source
(source_host=remote* OR dest_host=remote*)
| eval name=coalesce(source_host,dest_host)
| stats count by name

Thank you very much!

0 Karma

woodcock
Esteemed Legend

Try this:

index=my_index source=my_source (source_host=remote* OR dest_host=remote*)
| multireport
[ stats count by source_host]
[ stats count by dest_host ]
| eval name=coalesce(source_host,dest_host)
| fields - *_host
0 Karma

sumanssah
Communicator

minor amendments 🙂

  index=my_index source=my_source (source_host=remote* OR dest_host=remote*)
 | multireport
 [ stats count by source_host]
 [ stats count by dest_host ]
 | eval name=coalesce(source_host,dest_host)
 | fields - *_host
 | stats sum(count) as count by name

woodcock
Esteemed Legend

I agree. Missed it by >that< much.

0 Karma

woodcock
Esteemed Legend

Except you don't need the fields - *_host in that case.

0 Karma

koshyk
Super Champion

The above search seems to be good. it should be constrained by limits.conf only
What type of limit you hitting?

0 Karma

alc2019
New Member

I was trying to apply the answer from this good post, but I cannot make it work.

The coalesce results only one side. I want to count each time a host appears on either source_host or destination_host.

https://answers.splunk.com/answers/524250/how-to-search-for-matches-in-two-different-searche.html

link text

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...