topic Combine column values and search in Splunk Search

Combine column values and search

chiilii — Fri, 20 Aug 2021 09:33:31 GMT

I have a dynamic table extracted from a search result. Example Table1 that I can get:

Error	Code	Computer
Internet Connection	100	CompA
Blue Screen		CompB
App Crash	5	CompC

My desired result:
For each row in the Table1, I would like to join the columns and make multisearch as below.

index=computer OR index=application (Internet Connection AND 100 AND CompA) | tail 1 index=computer OR index=application (Blue Screen AND CompB) | tail 1 index=computer OR index=application (App Crash AND 5 AND CompC) | tail 1

I didn't use format in this case because it would end up like..

index=computer OR index=application ( (Internet Connection AND 100 AND CompA) OR (Blue SCreen AND CompB) OR (App Crash AND 5 AND CompC) )

and returns many result instead of only 3 results.

Is the desired result possible to achieve?

Re: Combine column values and search

venkatasri — Thu, 19 Aug 2021 04:41:36 GMT

Hi @chiilii

You have to extract fields required Error, code and computer for _raw events first and apply | table command should show you the output required.

How is your original events looks like?

Re: Combine column values and search

chiilii — Fri, 20 Aug 2021 09:31:20 GMT

Hi @venkatasri

Thanks for looking at this. I am able to get the table but not able to break the table into this:

index=computer OR index=application (Internet Connection AND 100 AND CompA) | tail 1
index=computer OR index=application (Blue Screen AND CompB) | tail 1
index=computer OR index=application (App Crash AND 5 AND CompC) | tail 1

Re: Combine column values and search

venkatasri — Thu, 19 Aug 2021 11:34:21 GMT

what you are trying to achieve? | tail=1 is not a valid command.

Re: Combine column values and search

chiilii — Fri, 20 Aug 2021 09:31:51 GMT

Sorry have updated the tail and my post too. Hope it is more understandable