topic Re: How to extract data in Splunk Search

How to extract data

1014502 — Thu, 06 Feb 2020 03:47:16 GMT

I want to know how to take data from multiple data sources by ID.
The following is an example of a data source.
A Datasource(A-id,B-id or C-id,B-Manhour or C-Manhour)
B Datasource(B-id,B-subject)
C Datasource(C-id,B-id,C-subject)
※A datasource is Man-hour information、B Datasource is Parent ticket information、C-datasource is Child ticket information

I want the output below.
id subject man-hour
B-id B-subject Total value of B-Manhour
B-id B-subject Total value of B-Manhour+Total value of C-Manhour
B-id B-subject Total value of C-Manhour

Please tell me how to do it.

Re: How to extract data

gcusello — Thu, 06 Feb 2020 13:55:44 GMT

Hi @1014502,
your requisites aren't so clear, correct me if I'm wrong:

in A Datasource all the fields are in different columns (A-id,B-id or C-id,B-Manhour or C-Manhour);
you want different calculations for each row (in row1 B-Manhour, in row2 B-Manhour+Total value of C-Manhour and in row3 C-Manhour)
you want three rows for each B-id,
relation between B-id and C-id is in C Datasource.

Is it correct?

Ciao.
Giuseppe

Re: How to extract data

1014502 — Fri, 07 Feb 2020 01:06:49 GMT

Hi@gcusello
.in A Datasource all the fields are in different columns (A-id,B-id or C-id,B-Manhour or C-Manhour);

Example for A Datasource bellow.
( A-id,B-id,B-Manhour
A-id,C-id,C-Manhour )
A Datasource is the man-hour information of B ticket or C ticket.
・you want different calculations for each row (in row1 B-Manhour, in row2 B-Manhour+Total value of C-Manhour and in row3 C-Manhour)
Yes.
・you want three rows for each B-id,
Yes.
relation between B-id and C-id is in C Datasource.
Yes.

Re: How to extract data

to4kawa — Fri, 07 Feb 2020 02:02:54 GMT

index=your_index source=A OR source=B OR souce=C
| stats sum(Manhour) as Monhour values(subject) as subject by B-id , C-id

There is no sample, maybe not works.
That's life.

Re: How to extract data

gcusello — Sat, 08 Feb 2020 07:57:21 GMT

Hi @1014502,
if it's acceptable for you to have results in three columns, you could run something like this:

index=A Or index=B OR index=C
| stats sum(B-Manhour) AS B-Manhour sum(C-Manhour) AS C-Manhour BY B-id
| eval BC=B-Manhour+C-Manhour

I cannot test it, check in this way or adding C-id in BY clause of the stats command:

index=A Or index=B OR index=C
| stats sum(B-Manhour) AS B-Manhour sum(C-Manhour) AS C-Manhour BY B-id C-id
| eval BC=B-Manhour+C-Manhour

Ciao.
Giuseppe