topic Re: Step By Step Searches in Splunk Search

Step By Step Searches

jimjohn — Fri, 28 Feb 2014 12:21:59 GMT

Hi
If I feel difficult to achieve the search result in a single search,is there any way to do it in multiple steps like plsql procedures?
I mean i have 2 search result from 2 different sources and i want to merge the result is there any way?
i tried to join data but it will not solve my requirements.

Re: Step By Step Searches

wpreston — Fri, 28 Feb 2014 12:31:53 GMT

How about the append command?

... search 1 | append [search search 2 ...]

Re: Step By Step Searches

MuS — Fri, 28 Feb 2014 12:45:14 GMT

or use the two sources in the base search

source=1 OR source=2 searchstring1 OR searchstring2

Re: Step By Step Searches

wpreston — Fri, 28 Feb 2014 13:14:57 GMT

Agreed, much better than append if the searches lend themselves to it.

Re: Step By Step Searches

jimjohn — Fri, 28 Feb 2014 13:25:02 GMT

Ok fine.But In my requirement I doesn't have specific input sting.I need to group column data using transaction.

Re: Step By Step Searches

somesoni2 — Fri, 28 Feb 2014 14:08:37 GMT

It would be better if can share the two searches, you're using currently and the requirement for combined search.

Re: Step By Step Searches

wpreston — Fri, 28 Feb 2014 14:40:26 GMT

Without knowing more about your data or your requirements, like somesoni2 said, it is difficult to help. I'm guessing that you need to use transaction in both searches? If so, you could use transaction on either side of append, like so:

... your search 1 
| transaction <transaction options> 
| append [search your search 2 
    | transaction <options>]
| your report command

Or if you need to make a single transaction out of results from both searches you could try:

source=1 OR source=2 search1 OR search 2
| transaction <options>
| report command