topic Re: How can you display results from 2 contrasting text searches in 1 table with no designated key pairs? in Splunk Search

How can you display results from 2 contrasting text searches in 1 table with no designated key pairs?

Adam_Berliner_M — Wed, 29 Jun 2016 23:15:07 GMT

Afternoon!

Hope this isn't too basic of a question here, but I've been striking out on finding a similar search to use as an example.
I'm basically trying to parse 2 separate results out of the same log entry and display them in a single table.

Search 1:

host=ServerNumber1 sourcetype=log adventure NOT "Buck" | rename uniqueid as item1 | dedup item1 | table item1

Search 2:

host=ServerNumber1 sourcetype=log "Buck" | rename uniqueid as item2 | dedup item2 | table item2

I'm trying to figure out how to get item1 and item2 in to the same table in separate columns.
Any help would be appreciated!

Re: How can you display results from 2 contrasting text searches in 1 table with no designated key pairs?

sundareshr — Wed, 29 Jun 2016 23:46:53 GMT

How do you want the final display? Item1 & Item2 as different columns in your table. See if this gives you what your are looking for

host=ServerNumber1 sourcetype=log adventure NOT "Buck" | rename uniqueid as item1 | stats count by item1 | fields - count | appendcols [ host=ServerNumber1 sourcetype=log "Buck" | rename uniqueid as item2 | stats count by item2 | fields - count]

Re: How can you display results from 2 contrasting text searches in 1 table with no designated key pairs?

Adam_Berliner_M — Thu, 30 Jun 2016 00:40:20 GMT

Thanks for the response! Really appreciate it!
That got me what I needed...

For anyone else who happens apon this string, I had to make two changes to get it to work
1) had to add search after the appendcols [
2) had to move the | fields - count to OUTSIDE of the ].

So the final serach looked like:

host=ServerNumber1 sourcetype=log adventure NOT "Buck" | rename uniqueid as item1 | stats count by item1 | fields - count | appendcols [search host=ServerNumber1 sourcetype=log "Buck" | rename uniqueid as item2 | stats count by item2] | fields - count

Re: How can you display results from 2 contrasting text searches in 1 table with no designated key pairs?

rafasalo — Thu, 08 Sep 2016 12:40:58 GMT

What should I do if i want to reduce item2 from item1 and after that see the results as a table?