Implementing Splunk 7, Third Edition - Third Edition

Using sistats, sitop, and sitimechart

First, let's define some new functions:

• sistats: sistats is the summary indexing version of the stats command, which calculates the aggregate statistics over the dataset
• sitop: This is the summary indexing version of the top command, which returns the most frequent value of a field or a combination of fields
• sitimechart: sitimechart is the summary indexing version of the timechart command, which creates a time series chart visualization with the corresponding table of statistics

So far, we have used the stats command to populate our summary index. While this works very well, the si* variants have a couple of advantages:

• The remaining portion of the query does not have to be rewritten. For instance, ...