How to run same search for different source files?

deepthi5 — Mon, 13 Jul 2015 11:43:39 GMT

Hi Team,

Again an urgent requirement. I have got a couple csv files with source name c:\\budapest.csv, c:\\singapore.csv, c:\\germany.csv etc

All I wantt is some stats sorted with country and run the same search on all other files.

Right now I have a searcj where I am appending each and every source file with the same search which is becoming bigger as I add more subsearches:

source="C:\\Budapest Router1full.csv" host="SEZ00VVM-153"   sourcetype="csv" date_wday!=saturday AND date_wday!=sunday|  rex field=source "(?&lt;country&gt;.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename |where date_hour&gt;=start_hour AND date_hour&lt;= end_hour|eval Intraffic=IN/1048576 |bin _time span=1mon| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time   |eval total=Percentile/maxin*100|timechart span=1d values(total)   As Budapest(total%)|append[search source="C:\\Adelaide full.csv" date_wday!=saturday AND date_wday!=sunday|  rex field=source "(?&lt;country&gt;.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename |where date_hour&gt;=start_hour AND date_hour&lt;= end_hour|eval Intraffic=IN/1048576 |bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time   |eval total=Percentile/maxin*100|timechart span=1d values(total)   As Adelaide(total%)]

Please help

Thanks ,
Deepthi

Re: How to run same search for different source files?

HeinzWaescher — Mon, 13 Jul 2015 13:37:13 GMT

To use same query for different sources:

 source=budapest.csv OR source=singapore.csv OR source=germany.csv | *your search...*

topic How to run same search for different source files? in Splunk Search

How to run same search for different source files?

Re: How to run same search for different source files?