cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

DQL function replacing splunk command stats list

susmita_k
Organizer

is there a DQL Command/function available which can replace the stats list command in splunk ? Thanks in advance

1 REPLY 1

angelalanis
Dynatrace Advocate
Dynatrace Advocate

Hi, the stats command in Splunk is an aggregation command, in Dynatrace with DQL there are 3 aggregation commands.

 

Looking at this example in the Splunk documentation, I think something similar can be made using the summarize command with DQL.

I tried making this example in a Notebook, here are the results.

fetch logs
| filter matchesPhrase(content, "long transaction")
| parse content, """LD 'type ['LD:type']'"""
| parse content, """LD 'duration ['INT:duration']'"""
| summarize {count(), sum(duration), avg(duration), max(duration), min(duration)}, by:{type} 

angelalanis_1-1754070014813.png

Let me know if you find this useful.

Featured Posts