topic Re: connect/concatenate two searches into one and visualize it as a single value in Splunk Search

connect/concatenate two searches into one and visualize it as a single value

C4r7m4n — Wed, 11 Apr 2012 08:59:56 GMT

Hello

I have two searches:
Search A: BGP_NEIGHBOR_STATE_CHANGED source="udp:514" AND ("Established to Idle" OR "Established to Active" OR "Established to OpenConfirm" | stats count as BGP_DOWN | rangemap field=BGP_DOWN low=0-0 elevated=1-1 default=severe

I want to connect these two searches into one and represent it as a single value.

I've tried sth like this:

((BGP_NEIGHBOR_STATE_CHANGED ("Established to Idle" OR "Established to Active" OR "Established to OpenConfirm") OR (BGP-5-ADJCHANGE Down | rex  field=_raw "neighbor (?<neighbor>.*)" | table neighbor | dedup neighbor)) AND source="udp:514" | stats count as BGP_DOWN  | rangemap field=BGP_DOWN low=0-0 elevated=1-1 default=severe

But I get error: Error in 'search' command: Unable to parse the search: unbalanced parentheses.

Is there a way to connect/concatenate two searches into one and visualize this as a single value?

Best Regards,
C4r7m4n

Re: connect/concatenate two searches into one and visualize it as a single value

Ayn — Wed, 11 Apr 2012 09:14:04 GMT

Use append for this.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Append

Re: connect/concatenate two searches into one and visualize it as a single value

C4r7m4n — Wed, 11 Apr 2012 09:28:11 GMT

Hello @Ayn

I tried a couple of seconds ago what you have sent me and I've got error:

Search operation 'bgp' is unknown. You might not have permission to run this operation.

Re: connect/concatenate two searches into one and visualize it as a single value

Drainy — Wed, 11 Apr 2012 09:40:50 GMT

At the start of a search within [ ] to need to use the word search. I suspect you have copied and pasted your original search into the brackets.

Re: connect/concatenate two searches into one and visualize it as a single value

dart — Wed, 11 Apr 2012 10:08:14 GMT

Try:

source="udp:514" ((BGP_NEIGHBOR_STATE_CHANGED ("Established to Idle" OR "Established to Active" OR "Established to OpenConfirm") OR (BGP-5-ADJCHANGE Down)) | rex  field=_raw "neighbor (?<neighbor>.*)" | table neighbor | dedup neighbor | stats count as BGP_DOWN  | rangemap field=BGP_DOWN low=0-0 elevated=1-1 default=severe

Re: connect/concatenate two searches into one and visualize it as a single value

C4r7m4n — Thu, 12 Apr 2012 07:59:36 GMT

Hello @Ayn

Yes, You were right I didn't notice the search word.

I've changed this and it's worinking but I don't know why it's counting 2 time more 😞

This is my changed search:
BGP_NEIGHBOR_STATE_CHANGED source="udp:514" AND ("Established to Idle" OR "Established to Active" OR "Established to OpenConfirm") | append [search BGP-5-ADJCHANGE source="udp:514" Down | rex field=_raw "neighbor (?<neighbor>.*)" | table neighbor | dedup neighbor] | stats count as BGP_DOWN | rangemap field=BGP_DOWN low=0-0 elevated=1-1 default=severe

With code: stats count as BGP_DOWN | rangemap field=BGP_DOWN low=0-0 elevated=1-1 default=severe

it's counting to 6 instead 3. Do you have any idea why?

Re: connect/concatenate two searches into one and visualize it as a single value

C4r7m4n — Thu, 12 Apr 2012 08:42:47 GMT

Hello @dart

Your code doesn't work for me. I have the same error as befor: Error in 'search' command: Unable to parse the search: unbalanced parentheses.

Secondly, i think it cannot work because in Search A there is not word neighbor so if you concatenate two first searches and the try to search regexp by neigbour, then when search A occure the regexp will not filtr this.

I don't know if I wrote this clearly...