Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Conditional count distinct if

$
0
0
Hello all, I'm looking to do a "count distinct value if record type = foobar" type of scenario. Hopefully, I'll be able to articulate what I'm trying to do here. record type A: record: person name: bob id: 123456 sex: m state: tx hp: 555-123-1234 dept: finance record: person name: jane id: 7949191 sex: f state: ca hp: 555-456-7890 dept: marketing record: person name: jane id: 7949191 sex: f state: ca hp: 555-456-7890 dept: marketing record type B: record: computer computername: mycomputer type: pc ram: 4GB ip: 1.1.1.1 dept: finance record: computer computername: mylaptop type: laptop ram: 4GB ip: 2.2.2.2 dept: finance record: computer computername: theserver type: server ram: 16GB ip: 10.0.0.1 dept: marketing stats if(record="computer",dc(computername)) as dc_computer if(record="person",dc(id)) as dc_people by dept desired result: dept dc_computer dc_people finance 2 1 marketing 1 2

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>