topic Re: three search in same page with alert and time span=3 month in Splunk Search

three search in same page with alert and time span=3 month

logloganathan — Tue, 20 Mar 2018 09:52:35 GMT

i want to do three different search in same page for time span is 3 month
i need a alert to be configured

Re: three search in same page with alert and time span=3 month

logloganathan — Tue, 20 Mar 2018 10:50:12 GMT

any update?

Re: three search in same page with alert and time span=3 month

kmaron — Tue, 20 Mar 2018 12:29:29 GMT

Can you please provide more information.
What are you searching for? What are your searches? Is this a dashboard? What do you want to alert on?

Re: three search in same page with alert and time span=3 month

logloganathan — Tue, 20 Mar 2018 12:48:18 GMT

no its not dashboard i want to do search to find 3 data count..all are different.
is there any way to do that apart from dashboard?

Re: three search in same page with alert and time span=3 month

kmaron — Tue, 20 Mar 2018 12:50:43 GMT

you need to provide more information
please give examples of the events you're searching and explain what counts you want

Re: three search in same page with alert and time span=3 month

logloganathan — Tue, 20 Mar 2018 13:00:14 GMT

yes..
index=A sourectype=B "XXX" | stats count by XXX
index=A sourectype=B "YYY" | stats count by YYY
index=A sourectype=B "ZZZ" | stats count by ZZZ

i want these three table in one page and alert configured for this

Re: three search in same page with alert and time span=3 month

p_gurav — Tue, 20 Mar 2018 13:01:00 GMT

Is your alert depend on output of 3 different searches? Can you share your searches and alert conditions ?

Re: three search in same page with alert and time span=3 month

p_gurav — Tue, 20 Mar 2018 13:05:18 GMT

did you try usingappend command?

index=A sourectype=B "XXX" | stats count by XXX |append [search index=A sourectype=B "YYY" | stats count by YYY] | append [search index=A sourectype=B "ZZZ" | stats count by ZZZ]

Re: three search in same page with alert and time span=3 month

logloganathan — Tue, 20 Mar 2018 15:05:26 GMT

thanks..please post this in answer tab

Re: three search in same page with alert and time span=3 month

niketn — Tue, 20 Mar 2018 18:26:24 GMT

@logloganathan you should explore the multisearch command which is not restricted by sub-search limitations

| multisearch 
    [search index=A sourcetype=B XXX=*]
    [search index=A sourcetype=B YYY=*]
    [search index=A sourcetype=B ZZZ=*]
| stats count by XXX YYY ZZZ

However, Splunk has numerous event grouping and correlation mechanisms based on the Use Cases and we can not always apply any one of the correlation mechanism for all the scenarios.

So you should elaborate on what exactly is your use case. If you are planning to pull 3 months of data to create an alert, could you rely on summary indexing instead? Community would be able to assist you better you add more context to your questions like what is your use case, what does your data look like? What have you tried so far and what does not seem to work?

I dont think a doctor should treat patient based on hunch rather the cure should be based upon symptoms!!! So for us to help you better add as much of details as possible to your questions 🙂

Re: three search in same page with alert and time span=3 month

logloganathan — Wed, 21 Mar 2018 07:10:58 GMT

I can provide only example use cases..i can't provide organization data..i already provided example query I just need output for that and i got it from you..thanks for that

Re: three search in same page with alert and time span=3 month

niketn — Thu, 22 Mar 2018 06:18:37 GMT

I am glad you are able to resolve the issue that you are facing. Yes we understand that organization data can not be published on public forums, however, usually request here on Splunk Answers is for mocked/anonymized data. In fact most of the times if sensitive information is posted accidentally by folks, community moderators do reach out to them for masking/anonymizing the same.

Following is an example of anonymized data in similar format to how original event might have triggered in the system, but without revealing any sensitive information.

2017/01/12 08:09:04.325 AM [ERROR] Login failed for abc@def.com on server servername01@domain.com.

Having said that I am still curious on the use case for pulling 3 months data for an alert. It is up to you whether you want to post the use case or not since your issue is already resolved! 🙂