topic Re: multisearch in Splunk Search

multisearch

zakura — Sun, 26 Sep 2021 13:55:56 GMT

Hi , I have 2 queries :

index="bar_*" sourcetype =foo crm="ser"
| dedup uid
| stats count as TotalCount

and

index="bar_*" sourcetype =foo crm="ser" jet="fas"
| dedup uid
| stats count as TotalFalseCount

I need both of these queries merged and then take "TotalCount" and "TotalFalseCount" and get value from these as : ActualPercent= (TotalFalseCount/TotalCount)*100.

I created one query as below:

but the value of "Percent" is completely wrong, can anybody help to know how can I get proper value of "Percent" in above case ?

Re: multisearch

richgalloway — Sun, 26 Sep 2021 21:31:40 GMT

One problem with the appendcols command is it depends on the order of results being identical in both queries, which is not likely.

Use the append command instead then combine the two set of results using stats.

Re: multisearch

zakura — Mon, 27 Sep 2021 04:01:53 GMT

With Minor modification it exactly helped to do what I was looking for :

index="bar_*" sourcetype =foo crm="ser"

| dedup uid

| stats count as TotalCount by zerocode SubType

| append

[search index="bar_*" sourcetype =foo crm="ser" jet="fas"

| dedup uid

| stats count as TotalFalseCount by zerocode SubType]

| stats values as * by zerocode SubType

| eval Percent=(TotalFalseCount/TotalCount)*100

| eval Percentage = round('Percent',2)

| xyseries SubType zerocode Percentage

| fillnull value="NA"

Re: multisearch

zakura — Mon, 27 Sep 2021 04:02:53 GMT

@richgalloway -- You are awesome ! Thanks a lot !