topic Re: multiple searches for stats in Splunk Search

multiple searches for stats

kishan2356 — Wed, 05 Jan 2022 16:07:52 GMT

I have two searches where I need to run an stats count on to do some calculations. First search is

index=xxx wf_id=xxx wf_env=xxx xxx | stats count

Second search is

index=xxx wf_id=xxx wf_env=xxx sourcetype=xxx usecase=xxx | stats count by request_id

First search uses a simple stats to get its count, but the second search uses stats count by request_id so I am having trouble getting the counts for both. Ideally I would like to get the counts for both searches and divide them. I've used appendcols but it returns empty fields for both searches. Any guidance on how to get counts for these searches would be helpful!

Working example:

_time	Search 1 counts	Search 2 counts	Search 1/ Search 2
00:30	50	25	2
00:35	100	25	4

Re: multiple searches for stats

gcusello — Wed, 05 Jan 2022 16:39:13 GMT

Hi @kishan2356,

did you tried appendpipe?

something like this:

index=xxx wf_id=xxx wf_env=xxx sourcetype=xxx usecase=xxx | stats count by request_id | appendpipe [ search index=xxx wf_id=xxx wf_env=xxx xxx | stats count rename count AS total ] | eval perc=count/total

Ciao.

Giuseppe

Re: multiple searches for stats

kishan2356 — Wed, 05 Jan 2022 16:56:37 GMT

This returns an empty field

Re: multiple searches for stats

gcusello — Wed, 05 Jan 2022 17:05:28 GMT

Hi @kishan2356,

in my test I have two rows: one with empty field and one with the valued fiel, you could filter for the fields with the value:

Ciao.

Giuseppe

Re: multiple searches for stats

kishan2356 — Mon, 10 Jan 2022 16:56:33 GMT

Thank you for the reply Giuseppe,

Hi am still getting black fields when using appendpipe.

Re: multiple searches for stats

gcusello — Mon, 10 Jan 2022 17:27:51 GMT

Hi @kishan2356,

please try this:

Ciao.

Giuseppe