topic Re: Not Getting result while trying to pass result of one query to other in Splunk Search

Not Getting result while trying to pass result of one query to other

kirrusk — Thu, 11 Jun 2020 06:50:33 GMT

Hi All,

I'm trying to pass result of one query to other. but not able to achieve this.

Can someone help on this.

Query1

index = "internal" sourcetype= "*" Space = "*" Microservice="*" | eval Microservice=lower(Microservice) | dedup Space,Microservice| stats count by Microservice | where count>1

query2

index ="internal" sourcetype= "*" Space = "*" Microservice="*" Org="*" | table Microservice Org Space

result of first query is

Microservice count

app1 2

app2 2

app3 3

so i want to pass this Microservices to second query and get result as

Microservice Org Space

Here i'm trying to find duplicate microservices and get Org and space accordingly.

Re: Not Getting result while trying to pass result of one query to other

skrajkumar_splu — Thu, 11 Jun 2020 07:11:34 GMT

Try using join command like below

Query 1 | join Microservice type=left[search Query2]

Re: Not Getting result while trying to pass result of one query to other

kirrusk — Thu, 11 Jun 2020 08:02:21 GMT

Thankyou

I'm able to join . but i'm not getting result as expected.

I want the result to be as

Org Space Microservice count

org1 space1 app1 1

Org2 space2 app1 1

but i'm getting result as

Org Space Microservice count

Org1 Space app1 2

here i want to find duplicate microservice along with Org and space values.

Can u help on this