Implementing Splunk - Second Edition

Using sistats, sitop, and sitimechart

First, let's define some new functions:

• Sistats: sistats is the summary indexing version of the stats command, which calculates the aggregate statistics over the dataset.
• Sitop: sitop is the summary indexing version of the top command, which returns the most frequent value of a field or a combination of fields.
• Sitimechart: sitimechart is the summary indexing version of the timechart command, which creates a time-series chart visualization with the corresponding table of statistics.

So far, we have used the stats command to populate our summary index. While this works perfectly well, the si* variants have a couple of advantages:

• The remaining portion of the query does not have to be rewritten. For instance, stats ...