You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Sample Query: "'\n| inputlookup service_inventory_lookup\n| where not like (scope, \"cust01-gss01%\")\n\n| where like (serviceName, \"WFM-BGP\") or like (serviceName, \"WFM-API\") or like (serviceName, \"WFM-Backend\") or like (serviceName, \"WFM-UDM\") or like (serviceName, \"WFM-BGI\")\n\n\n| where like(scope, \"cust01%\") OR like(scope, \"gcp-cust01\")\n| dedup groupName\n| table groupName serviceName scope\n| sort by groupName asc\n| streamstats count(groupName) as koogle_index reset_after=\"koogle_index=1\"\n| join type=left scope\n[\n| inputlookup service_inventory_lookup\n| where not like (scope, \"cust01-gss01%\")\n\n| where like (serviceName, \"WFM-BGP\") or like (serviceName, \"WFM-API\") or like (serviceName, \"WFM-Backend\") or like (serviceName, \"WFM-UDM\") or like (serviceName, \"WFM-BGI\")\n\n\n| where like(scope, \"cust01%\") OR like(scope, \"gcp-cust01\")\n| dedup scope\n| eval temp = split(scope, \"-\")\n| where mvcount(temp) > 3\n| table scope\n| sort by scope asc\n| streamstats count(scope) as koogle_index reset_after=\"koogle_index=1\"\n]\n'"
The text was updated successfully, but these errors were encountered:
Description
Add streamstats command
reference:https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Streamstats
Sample Query:
"'\n| inputlookup service_inventory_lookup\n| where not like (scope, \"cust01-gss01%\")\n\n| where like (serviceName, \"WFM-BGP\") or like (serviceName, \"WFM-API\") or like (serviceName, \"WFM-Backend\") or like (serviceName, \"WFM-UDM\") or like (serviceName, \"WFM-BGI\")\n\n\n| where like(scope, \"cust01%\") OR like(scope, \"gcp-cust01\")\n| dedup groupName\n| table groupName serviceName scope\n| sort by groupName asc\n| streamstats count(groupName) as koogle_index reset_after=\"koogle_index=1\"\n| join type=left scope\n[\n| inputlookup service_inventory_lookup\n| where not like (scope, \"cust01-gss01%\")\n\n| where like (serviceName, \"WFM-BGP\") or like (serviceName, \"WFM-API\") or like (serviceName, \"WFM-Backend\") or like (serviceName, \"WFM-UDM\") or like (serviceName, \"WFM-BGI\")\n\n\n| where like(scope, \"cust01%\") OR like(scope, \"gcp-cust01\")\n| dedup scope\n| eval temp = split(scope, \"-\")\n| where mvcount(temp) > 3\n| table scope\n| sort by scope asc\n| streamstats count(scope) as koogle_index reset_after=\"koogle_index=1\"\n]\n'"
The text was updated successfully, but these errors were encountered: