topic Re: How to combine multiple queries into one? in Splunk Search

How to combine multiple queries into one?

vintik — Thu, 06 Sep 2018 08:18:30 GMT

Hello,

I have multiple queries with small differences, is it possible to combine them?

Here is example:

index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName1)  | eval duration=span_duration/1000 | stats p99(duration)

index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName2 OR span_name=SomeSpanName3)  | eval duration=span_duration/1000 | stats p99(duration)

index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName4)  | eval duration=span_duration/1000 | stats p99(duration)

The result of each query is only one column p99(duration) with value.

Is it possible to combine these queries and get a result with three columns with different names (I need to know the correspondence of each column to the condition)?

Re: How to combine multiple queries into one?

harsmarvania57 — Thu, 06 Sep 2018 08:35:55 GMT

Hi @vintik,

Please try below query.

index=some_index sourcetype=some_source host=*host* (span_name=SomeSpanName1 OR span_name=SomeSpanName2 OR span_name=SomeSpanName3 OR span_name=SomeSpanName4)
| eval duration=span_duration/1000
| stats p99(eval(if(span_name="SomeSpanName1",duration,0))) AS p99_Span1, p99(eval(if(span_name="SomeSpanName2" OR span_name="SomeSpanName3",duration,0))) AS p99_Span2_3, p99(eval(if(span_name="SomeSpanName4",duration,0))) AS p99_Span4

I have created run anywhere search as below which gives me correct result.

| makeresults | eval span_name="SomeSpanName1", span_duration="1001"
| append [ makeresults | eval span_name="SomeSpanName2", span_duration="2001" ]
| append [ makeresults | eval span_name="SomeSpanName3", span_duration="3001" ]
| append [ makeresults | eval span_name="SomeSpanName4", span_duration="4001" ]
| eval duration=span_duration/1000
| stats p99(eval(if(span_name="SomeSpanName1",duration,0))) AS p99_Span1, p99(eval(if(span_name="SomeSpanName2" OR span_name="SomeSpanName3",duration,0))) AS p99_Span2_3, p99(eval(if(span_name="SomeSpanName4",duration,0))) AS p99_Span4

Re: How to combine multiple queries into one?

HiroshiSatoh — Thu, 06 Sep 2018 09:08:39 GMT

Try this!

 index=some_index sourcetype=some_source host=*host*  (span_name=SomeSpanName1 OR span_name=SomeSpanName2 OR span_name=SomeSpanName3 OR span_name=SomeSpanName4)
| eval duration=span_duration/1000 | stats p99(duration)  by span_name
| transpose header_field=span_name| fields - column