topic Re: How to range columns and rows ? in Knowledge Management

How to range columns and rows ?

jw44250 — Mon, 10 Apr 2017 21:30:24 GMT

I have the following result from Splunk Query using appCols because same logs always has different events with different message

message1 or message2 just a name..

Message Count1 Message2 count2
hello 5 hi 10

Output i am looking is :
Message count --< Header Fields>
hello 5

hi 10

Re: How to range columns and rows ?

somesoni2 — Mon, 10 Apr 2017 21:33:44 GMT

Instead of appendcols, you should use just append. Also, remember to rename the fields in 2nd search (Message2 and count2) same as first search.

search 1 | table Message Count
| append [search 2 | table Message2 Count2 | rename Message2 as Message Count2 as Count ]

See this to know difference between append and appendcols.
https://answers.splunk.com/answers/144351/what-are-the-differences-between-append-appendpipe.html

Re: How to range columns and rows ?

jw44250 — Mon, 10 Apr 2017 21:56:13 GMT

it is same index. but i have to extract different fields each time from events.. since the events returns has different message

Re: How to range columns and rows ?

jw44250 — Mon, 10 Apr 2017 21:57:39 GMT

i using transport i didnt work ..

Re: How to range columns and rows ?

jw44250 — Mon, 10 Apr 2017 22:03:11 GMT

Thanks it did work.

Re: How to range columns and rows ?

somesoni2 — Mon, 10 Apr 2017 22:22:17 GMT

Glad it's working for you. If it's same index, you probably don't need a subsearch. If you could share you search, we can look at it to see if both searches can be merged into one for better performance.

Re: How to range columns and rows ?

jw44250 — Tue, 29 Sep 2020 13:35:52 GMT

Here is the Splunk Query..

Re: How to range columns and rows ?

jw44250 — Tue, 11 Apr 2017 16:21:02 GMT

When adding timechart span=3h count usenull=f useother=f into both indexes getting error :- please rename count columns.

Re: How to range columns and rows ?

somesoni2 — Tue, 11 Apr 2017 16:25:21 GMT

Give this a try

(index=index1 sourcetype=index1_log) OR (index=index2 sourcetype=index2_log) 
| rex field=_raw "(?<Message>(exception|message)\s\w+\s\w+)" 
|stats count as "Hit Count" by Message

Re: How to range columns and rows ?

somesoni2 — Tue, 11 Apr 2017 16:25:47 GMT

YOu're getting that in same query?

Re: How to range columns and rows ?

jw44250 — Tue, 11 Apr 2017 16:40:44 GMT

let me tried it..thanks