Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[STORY] SPL: Add streamstats #750

Open
nbhavana opened this issue Apr 16, 2024 · 1 comment
Open

[STORY] SPL: Add streamstats #750

nbhavana opened this issue Apr 16, 2024 · 1 comment

Comments

@nbhavana
Copy link
Collaborator

Description

Add streamstats command

reference:https://docs.splunk.com/Documentation/SplunkCloud/9.1.2312/SearchReference/Streamstats

Sample Query:
"'\n| inputlookup service_inventory_lookup\n| where not like (scope, \"cust01-gss01%\")\n\n| where like (serviceName, \"WFM-BGP\") or like (serviceName, \"WFM-API\") or like (serviceName, \"WFM-Backend\") or like (serviceName, \"WFM-UDM\") or like (serviceName, \"WFM-BGI\")\n\n\n| where like(scope, \"cust01%\") OR like(scope, \"gcp-cust01\")\n| dedup groupName\n| table groupName serviceName scope\n| sort by groupName asc\n| streamstats count(groupName) as koogle_index reset_after=\"koogle_index=1\"\n| join type=left scope\n[\n| inputlookup service_inventory_lookup\n| where not like (scope, \"cust01-gss01%\")\n\n| where like (serviceName, \"WFM-BGP\") or like (serviceName, \"WFM-API\") or like (serviceName, \"WFM-Backend\") or like (serviceName, \"WFM-UDM\") or like (serviceName, \"WFM-BGI\")\n\n\n| where like(scope, \"cust01%\") OR like(scope, \"gcp-cust01\")\n| dedup scope\n| eval temp = split(scope, \"-\")\n| where mvcount(temp) > 3\n| table scope\n| sort by scope asc\n| streamstats count(scope) as koogle_index reset_after=\"koogle_index=1\"\n]\n'"

@SaiHimaja
Copy link

Hi Team,
I would like to work on this

Thanks

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants