Splunk Search

How to get count of multiple strings with common index and source type?

habisht
Explorer

I'm trying to create a dashboard which will display pie-charts from different results. For this, I've multiple strings from same index and same source type.
What I've tried:
1. get counts from each and then use in pie-chart with tokens.
2. append required search results and then use them in pie-chart.
Both are OK. but i think there might be some effective way to do this.

like: index=$index$ sourcetype=$sourcetype$ "my test string1" | count AS count1 "my test string2" | count AS count2

0 Karma
1 Solution

renjith_nair
Legend

@habisht,

Test this with one of your strings,

index=$index$ sourcetype=$sourcetype$ ("my test string1"  OR "my test string2" OR ..)
|stats count(eval(searchmatch("my test string1"))) as string1 ,count(eval(searchmatch("my test string2"))) as string2, ...
Happy Splunking!

View solution in original post

renjith_nair
Legend

@habisht,

Test this with one of your strings,

index=$index$ sourcetype=$sourcetype$ ("my test string1"  OR "my test string2" OR ..)
|stats count(eval(searchmatch("my test string1"))) as string1 ,count(eval(searchmatch("my test string2"))) as string2, ...
Happy Splunking!

habisht
Explorer

Thanks @renjith.nair it worked.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...