topic Re: Correlation using OR ? in Splunk Search

Correlation using OR ?

sbnoobbb — Tue, 16 Jul 2013 06:59:05 GMT

I have used this search command to display timechart and I need to search between two sourcetype and return the specific location from sourcetype="CurrentWeatherSGTraffic" but it returns me all the location even from sourcetype="ltaTraffic". How can I return location only from sourcetype="CurrentWeatherSGTraffic". (note that sourcetype="CurrentWeatherSGTraffic" has the location extracted and is the same as sourcetype="ltaTraffic")

sourcetype="CurrentWeatherSGTraffic" OR sourcetype="ltaTraffic" | timechart count(eval(current_summary="Partly Cloudy")) as Cloudy , count(eval(Type=="Accident")) as Ancident by Location

Re: Correlation using OR ?

Ayn — Tue, 16 Jul 2013 07:03:45 GMT

If both sourcetypes carry the same values for Location, I don't see what the problem is? Or for that matter how you want it to look instead?

Re: Correlation using OR ?

sbnoobbb — Tue, 16 Jul 2013 07:05:37 GMT

My mistake, sourcetype="CurrentWeatherSGTraffic" contains only 6 Location while sourcetype="ltaTraffic" contains a lot.

Re: Correlation using OR ?

Drainy — Tue, 16 Jul 2013 07:10:55 GMT

Brackets should do the trick;

(sourcetype="CurrentWeatherSGTraffic" Location=*) OR (sourcetype=ltaTraffic NOT Location=*)

But, how will you do a By Location in the timechart if the ltaTraffic events don't have a Location?

Re: Correlation using OR ?

sbnoobbb — Tue, 16 Jul 2013 07:14:40 GMT

I needed only the 6 location from sourcetype="CurrentWeatherSGTraffic", which the 6 location is also in ltatraffic. Thanks !

Re: Correlation using OR ?

sbnoobbb — Tue, 16 Jul 2013 07:25:24 GMT

I had a null field for ltatraffic Location as all the other location is added into NULL, is there anyway to not show it ?

Re: Correlation using OR ?

Ayn — Tue, 16 Jul 2013 07:37:11 GMT

This sounds dangerous - if ALL your Itatraffic events have the Location field, by doing "NOT Location=*" you are effectively removing all ItaTraffic events from your search altogether.

Re: Correlation using OR ?

kailun92 — Tue, 16 Jul 2013 07:50:21 GMT

How can I correct it ? I only need the six location.

Re: Correlation using OR ?

sbnoobbb — Tue, 16 Jul 2013 08:05:25 GMT

I believed all my location that has accidents has changed to NULL. Including the 6 location I needed.

Re: Correlation using OR ?

Ayn — Tue, 16 Jul 2013 08:07:29 GMT

If ItaTraffic contains many more locations than the only 6 from CurrentWeatherSGTraffic you care about, my advice would be to create a filter for these using a subsearch.

sourcetype="CurrentWeatherSGTraffic" OR sourcetype=ltaTraffic [search sourcetype="CurrentWeatherSGTraffic" | dedup Location | fields Location] | timechart count(eval(current_summary="Partly Cloudy")) as Cloudy , count(eval(Type=="Accident")) as Accident by Location

This will add the Location values from CurrentWeatherSGTraffic as a filter string in your search.

Re: Correlation using OR ?

sbnoobbb — Tue, 16 Jul 2013 08:12:24 GMT

Thanks you are right ! 😃