topic Re: Can you help me with a complex subsearch? in Splunk Search

Can you help me with a complex subsearch?

jip31 — Thu, 03 Jan 2019 08:39:56 GMT

I use the request below in order to count degradation stop performances by service name

index="windows" sourcetype="wineventlog:microsoft-windows-diagnostics-performance/operational" Type=* OpCode="Détérioration de l’arrêt" TaskCategory="Analyse des performances d’arrêt" Nom_du_fichier=* "Durée de la dégradation"=* 
 | stats dc(Durée de la dégradation) as Total by Nom_du_fichier | sort -Total limit=10

You can see the result here

https://cjoint.com/c/IAdiC08SQZd

Now, I want to match these requests with this one :

index="windows-fr" sourcetype=WinRegistry key_path=\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry | eval NATCO=if(key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data, null)
| stats values(NATCO) as NATCO by host 
| stats dc(host) as host by NATCO | sort -NATCO limit=10

My goal is to count degradation stop performances by service name and by NATCO.

So, I would like to have in a same table the same thing that there is in the capture but also with a NATCO column.

Could you help me please??

Re: Can you help me with a complex subsearch?

raphgoncalves — Thu, 03 Jan 2019 09:18:27 GMT

If you have a common ID, you could use "join" command : https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join

Re: Can you help me with a complex subsearch?

jip31 — Thu, 03 Jan 2019 16:38:47 GMT

I dont succeed...

Re: Can you help me with a complex subsearch?

jip31 — Thu, 03 Jan 2019 16:42:57 GMT

And no commun ID..

Re: Can you help me with a complex subsearch?

raphgoncalves — Thu, 03 Jan 2019 16:44:42 GMT

Maybe I could help if you give events sample for your requests

Re: Can you help me with a complex subsearch?

jip31 — Fri, 04 Jan 2019 09:40:55 GMT

I have done this

index="windows" sourcetype="wineventlog:microsoft-windows-diagnostics-performance/operational" Type=* OpCode="Détérioration de l’arrêt" TaskCategory="Analyse des performances d’arrêt" Nom_du_fichier=* "Durée de la dégradation"=* | stats count by host   
| join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry"  | eval NATCO=if(key_path=="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data, null) | stats latest(NATCO) as NATCO by host]
| stats values(NATCO) as NATCO by host | stats count as Total by NATCO
| sort -Total limit=10

Re: Can you help me with a complex subsearch?

raphgoncalves — Fri, 04 Jan 2019 09:42:59 GMT

so you have a common id 😉
Great to know that it helped 🙂

Re: Can you help me with a complex subsearch?

jip31 — Fri, 04 Jan 2019 11:15:55 GMT

thanks!!!!

Re: Can you help me with a complex subsearch?

raphgoncalves — Fri, 04 Jan 2019 11:18:34 GMT

Just in case someone come over this question, I suggested OP to use "Join" Command : https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join

He came up with the following search

index="windows" sourcetype="wineventlog:microsoft-windows-diagnostics-performance/operational" Type=* OpCode="Détérioration de l’arrêt" TaskCategory="Analyse des performances d’arrêt" Nom_du_fichier=* "Durée de la dégradation"=* | stats count by host   
 | join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry"  | eval NATCO=if(key_path=="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data, null) | stats latest(NATCO) as NATCO by host]
 | stats values(NATCO) as NATCO by host | stats count as Total by NATCO
 | sort -Total limit=10