topic Multi Index combination in Splunk Search

Multi Index combination

jerinvarghese — Fri, 16 Oct 2020 14:40:58 GMT

Hi All,

Need to combine 2 index together and also need the values to be added/summed together.

Code 1 :

index=nw_syslog message_type="BGP-5-ADJCHANGE" | stats count by nodelabel, message_type | table nodelabel, message_type, count

Table 1 :

nodelabel	message_type	count
AOKBF	BGP PEER LOST	2
CMPRS	BGP PEER LOST	2

Code 2:

index=opennms | stats count by nodelabel, message_type | table nodelabel, message_type, count

Table 2:

nodelabel	message_type	count
AOKBF	BGP PEER LOST	3
CMPRS	BGP PEER LOST	3

I used append and also join type=outer nodelabel but the value is not added.

Expected Table Final :

nodelabel	message_type	count
AOKBF	BGP PEER LOST	5
CMPRS	BGP PEER LOST	5

Re: Multi Index combination

gcusello — Fri, 16 Oct 2020 15:03:45 GMT

Hi @jerinvarghese,

if you have the same field names in both indexes is easier you can think:

(index=nw_syslog message_type="BGP-5-ADJCHANGE") OR (index=opennms) | stats count BY nodelabel message_type | table nodelabel, message_type, count

if instead you have different field names, you have to rename them to have the same field names.

In this way, you haven't the limit of 50,000 results in subsearches that you'd have using join or append.

Ciao.

Giuseppe

Re: Multi Index combination

jerinvarghese — Tue, 20 Oct 2020 13:20:03 GMT

Hi @gcusello ,

Got another solution

index=nw_syslog message_type="BGP-5-ADJCHANGE" | table nodelabel, message_type, count | append [ search index=opennms | table nodelabel, message_type, count ] | stats count by nodelabel, message_type, count

this provided me the desired value. thanks so much for your suggestion too. that to helped me in the result.

Re: Multi Index combination

gcusello — Tue, 20 Oct 2020 14:16:45 GMT

Hi @jerinvarghese,

your solution is like mine, but beware if the second search could have more than 50,000 results, because there's this limit in subsearches.

then beware to use the same field name for count.

Ciao.

Giuseppe