topic Re: Search String but retain values in Splunk Search

Search String but retain values

tb5821 — Fri, 06 Apr 2012 21:49:28 GMT

new to splunk so go easy on me

I can currently run two different searches and get the the results I'm looking for but the problem is that its two different searches 🙂

The only field which they have in common is task_id how can I run both of these searches together still get the lines with the strings I'm interested in? Also within each search I'm renaming some of my fields ie ... | rename tt AS "Encode Time" and my other search is ... | rename tt AS "Copy Time"

Re: Search String but retain values

Damien_Dallimor — Fri, 06 Apr 2012 23:12:16 GMT

Try the transaction search command to stitch events together based on the common field :

... | transaction task_id

Not sure about the field renaming without seeing more concise examples of the events.

Re: Search String but retain values

tb582 — Fri, 06 Apr 2012 23:24:03 GMT

Unfortuantly I don't think its that easy I've tried all sorts of things join, set, append but just either not doing it in the right order or not doing it right at all. Here's an example of the two queries.

index=myindex sourcetype=app host=1* OR host=050 "SUCCESS : 100% : Encode completed" | rename Task_time as "Encode Time"

search index=myindex sourcetype=app host=1* OR host=050 "SUCCESS : 100% : Push Completed" | rename Task_time as "Transfer Time"

Re: Search String but retain values

Damien_Dallimor — Fri, 06 Apr 2012 23:55:17 GMT

You can setup Splunk "event types" for your different tasks.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Abouteventtypes

Re: Search String but retain values

gkanapathy — Sat, 07 Apr 2012 21:17:20 GMT

try this:

(sourcetype=A "encode") OR (sourcetype=B copying) | eval encode_time=if(searchmatch("encode"),tt,null()) | eval copy_time=if(searchmatch("copying"),tt,null())

Also, depending what you're doing the ... | stats ... by task_id command may be better than transaction task_id

Re: Search String but retain values

tb582 — Sat, 07 Apr 2012 23:00:58 GMT

does it matter that my source types are both the same?