topic Re: multisearch in table format in Splunk Search

multisearch in table format

shashidharh — Wed, 18 Nov 2020 11:34:32 GMT

Hi,

I was trying to add 2 searches

| multisearch [search host=p-css* SRCreateRequest 400 | stats count as CreateSR | appendcols [search host=p-css* SRUpdateRequest 400 | stats count as UpdateSR] | appendcols [search host=p-css* SREscalateRequest 400 | stats count as EscalateSR] | appendcols [search host=p-css* SRCloseRequest 400 | stats count as CloseSR] | eval type="400"] [appendcols search host=p-css* SRCreateRequest Publisher: Completed | stats count as CreateSR | appendcols [search host=p-css* SRUpdateRequest Publisher: Completed | stats count as UpdateSR] | appendcols [search host=p-css* SREscalateRequest Publisher: Completed | stats count as EscalateSR] | appendcols [search host=p-css* SRCloseRequest Publisher: Completed | stats count as CloseSR] | eval type="Completed"] | chart count(Name) over 400 by Completed

Getting error "Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)."

My expected output will be having a table format:

giving some example here

API	400	Completed
CreateSR	30	50
UpdateSR	5	25
CloseSR	24	30

Re: multisearch in table format

richgalloway — Wed, 18 Nov 2020 14:30:45 GMT

Appendcols is not a streaming command and cannot be used in multisearch.

Re: multisearch in table format

shashidharh — Thu, 19 Nov 2020 03:51:24 GMT

ohk, what could be the good solution for this query to get above result ?

Re: multisearch in table format

ITWhisperer — Thu, 19 Nov 2020 08:12:19 GMT

It depends what your data looks like!

Assuming you have fields API, status, publisher and completed,

host=p-css* (SRCreateRequest OR SRUpdateRequest OR SREscalateRequest OR SRCloseRequest) (400 OR (Publisher: AND Completed)) | eval fourhundred=if(status=400, 1, 0) | eval complete=if(publisher="Publisher:" AND completed="Completed", 1, 0) | stats sum(fourhundred) as "400" sum(complete) as Completed by API

Re: multisearch in table format

shashidharh — Thu, 19 Nov 2020 08:59:13 GMT

yes, it is not giving the output..

but modified as below .. here all APIs are not showing along with "Completed"

anything wrong ?

Re: multisearch in table format

ITWhisperer — Thu, 19 Nov 2020 10:44:56 GMT

There doesn't appear to be anything wrong, the absence of Completed and the other APIs from the results probably means they are absent from the events in your selected time period.

Re: multisearch in table format

shashidharh — Thu, 19 Nov 2020 11:54:23 GMT

hm yes, is it possible to display those columns & rows where we have "zero" values ?