topic Re: Merge two query resultsets in Splunk Search

How to Merge two query resultsets?

runiyal — Tue, 21 Jun 2022 15:58:13 GMT

I have two Searches and following are its result individually -

index="myindex" <my search 1> | table App Size Count

App Size Count
App1 5GB 100
App2 100GB 10000

index=myindex" <my search 2> | table App Size Count

App Size Count
App3 15GB 1500

Now I want to run a report that shows result of all Apps (1 to 3) together. So, I used append.

index="myindex" <my search 1> | table App Size Count
| append
[search index=myindex" <my search 2> | table App Size Count]
| addcoltotals

But when I used it, I didn't get the complete result. "Size" column is showing different value. Something like this -

App Size Count
App1 5GB 100
App2 100GB 10000
App3 7GB 720

What should be used to get the complete resultset as we got for each search. Best way to merge two query resultsets.

Thanks!

Re: Merge two query resultsets

gcusello — Sat, 18 Jun 2022 05:52:16 GMT

Hi @runiyal,

did you tried to put all the conditions in the main search?

something like this:

index="myindex" (<my search 1> OR <my search 2>) | table App Size Count | addcoltotals

Splunk isn't a DB!

Ciao.

Giuseppe

Re: Merge two query resultsets

renjith_nair — Sat, 18 Jun 2022 06:00:20 GMT

You may try

index=myindex (search1 terms OR search2 terms) |table App,Size,Count|addcoltotals

Re: Merge two query resultsets

runiyal — Sun, 19 Jun 2022 15:35:06 GMT

Here is the updated Query which actual use of REX/EVAL/CASE/STATS in it:

(index="myindex" "*upload succeeded" OR "*streaming succeeded" NOT "source"
| rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size count | eval App="Upload-Manual")
OR
(index="myindex" "*upload succeeded" OR "*streaming succeeded"
| rex "source=(?<App>[^,]+)."
| rex "system=(?<App>[^,]+)." | eval App = case(App="FB","App1",App="TWTR","App2",App="Salesforce","App3",App="SAP","App3",App="Oracle","App3")
| rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size Count by App)
| table App Size Count
| addcoltotals

I am getting following error -

Error in 'search' command: Unable to parse the search: unbalanced parentheses.

Thanks!

Re: Merge two query resultsets

runiyal — Sun, 19 Jun 2022 15:44:55 GMT

must be missing our something in the syntax but if I just use the OR between two searches like below I am getting Error in 'search' command: Unable to parse the search: unbalanced parentheses.

(<my search 1> OR <my search 2>)

I have provided the complete search command above in reply to Renjith.