topic Combining results in a search in Splunk Search

Combining results in a search

balcv — Mon, 16 Dec 2019 22:52:06 GMT

I have a search that graphs the number of events based on host name. It even colour codes into Windows and Linux hosts. The search goes like this:

(index="main" OR index="win*")
| stats count as total by host,index
| eval host=lower(host) 
| sort host 
| eval Linux = if(index=="main",total, 0) 
| eval Windows = if((index == "windows") or (index == "wineventlog"), total, 0) 
| fields host Linux Windows

This works exactly as expected except in the scenario when a host reports via two different indexes. When this occurs, the host is shown twice. Once for each index.

For example, host server1 has data indexed to Windows and to WinEventLog so two enteries appear for server1 (one for each index).

My question is, how can I get the search to combine the counts into a single entry so that I only see each host once.

I've tried something like "| eval Windows = if(index like "win%", total, 0)" but that does not give the desired result.

Any suggestions greatly appreciated.

Re: Combining results in a search

aberkow — Tue, 17 Dec 2019 00:21:22 GMT

After line 6, add a | stats sum(Linux) as Linux, sum(Windows) as Windows by host. This should take all of the numeric values for all indexes post-characterization of Linux or Windows and sum them by host.

The alternative is to put your two eval statements first, and then using the same command I showed above in place of your stats command, but that option might be slightly more expensive. You can try them both and assuming they return the same values, pick whichever one returns faster!

Hope this helps

Re: Combining results in a search

aberkow — Tue, 17 Dec 2019 00:22:55 GMT

The reason eval won't work to combine two rows is that it's a streaming command https://docs.splunk.com/Documentation/Splunk/8.0.0/Search/Typesofcommands#Streaming_and_non-streaming_commands and works on an event level, while stats, which I suggest below, is a transforming command (transforms after all rows are indexed and can do aggregations like you're interested in doing).

Re: Combining results in a search

balcv — Tue, 17 Dec 2019 01:03:02 GMT

That did the trick. Thank you @aberkow