Count count in splunk

Question

Can you do double counting in Splunk via time_span? I want to count the number of hits of number of fruits sold in an hour.

My code:

|bucket _time span=1h |eventstats count as count_in_an_hour by fruit time |stats count as count_count by fruit |table fruit count count_count |sort count_count count

I can run this with a bit of data; but because I have a huge number of data, it's taking very long and taking up a lot of space resulting in "not enough space error".

My sample set of data,

name    fruit   location time

mary    apple   east 5.10

ben pear    east 6.10

peter   pear    east 5.50

ben apple   north 7.10

ben mango   north 7.40

peter   mango   north 5.30

mary    orange  north 7.20

alice   pear    north 7.20

janet   pear    north 7.20

janet   mango   west 6.30

janet   mango   west 5.50

peter   mango   west 4.20

janet   pear    west 5.50

Answer 1

You can try asking your admin to increase your disk space limit, if that's the limiting factor.

If your admin has enabled the search_process_memory_usage_threshold setting then ask for the threshold to be increased.

Perhaps a better option is to reduce the number of results processed. You can do that in a few ways:

1. Use a smaller time window

2. Use the fields command early to reduce the amount of data processed

3. Make the base search as specific as possible to reduce the amount of data processed

For example:

index=foo name=* fruit=* earliest=-24h
| fields _time name fruit
| bucket _time span=1h 
| eventstats count as count_in_an_hour by fruit time 
| stats count as count_count by fruit 
| sort count_count count_in_an_hour 
| table fruit count_in_an_hour count_count