topic How to edit my search to add row header labels to the table of results? in Splunk Search

How to edit my search to add row header labels to the table of results?

vivekb — Wed, 30 Nov 2016 07:51:50 GMT

I have created following Splunk search:

host=xyz* index=my_index NOT(bot) earliest=-1d@d latest=-0d@d | eval searchid="Today" | stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404 | append [ search index=my_index host=pdap* index=os_web NOT(bot) earliest=-2d@d latest=-1d@d |eval searchid="Yesterday" | stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404]

Following is the result:

Exceptions              Errors             404
58                      95                 49
59                      135               94

My Question is: How do I add row labels like Today for first row and Yesterday for second row?

Re: How to edit my search to add row header labels to the table of results?

sundareshr — Wed, 30 Nov 2016 12:45:48 GMT

Try this

host=xyz* index=my_index NOT(bot) earliest=-2d@d latest=-0d@d 
| eval searchid=if(_time<relative_time(now(), "-1d@d"), "Today", "Yesterday")
| stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404 by searchid

Re: How to edit my search to add row header labels to the table of results?

alacercogitatus — Wed, 30 Nov 2016 12:49:14 GMT

You can combine this into a single search, but the important part is the by clause.

As you have it written:

 host=xyz* index=my_index NOT(bot) earliest=-1d@d latest=-0d@d | eval searchid="Today" | stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404 by searchid | append [ search index=my_index host=pdap* index=os_web NOT(bot) earliest=-2d@d latest=-1d@d |eval searchid="Yesterday" | stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404 by searchid]

As I would write it combined:

index=my_index host=pdap* index=os_web NOT(bot) earliest=-2d@d  latest=-0d@d |eval searchid=if(_time>relative_time(now(),"-1d@d"),"Today", "Yesterday")| stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404 by searchid

Re: How to edit my search to add row header labels to the table of results?

vivekb — Wed, 30 Nov 2016 14:34:59 GMT

Thanks a bunch. Saved my day.

Re: How to edit my search to add row header labels to the table of results?

vivekb — Wed, 30 Nov 2016 14:36:08 GMT

Thanks much. Perfect answer similar to what @sundareshr has posted. Since I can accept only one answer, I picked the first one. Thanks again.

Re: How to edit my search to add row header labels to the table of results?

vivekb — Wed, 30 Nov 2016 14:47:09 GMT

Thanks again. @sundeshOne extension to the query - Since relative_time function accepts two arguments -
How do I extrapolate to last 7 days?

E.g.
Today
Yesterday
2 Days Prior
3 Days Prior

Thanks.

Re: How to edit my search to add row header labels to the table of results?

ppablo — Thu, 01 Dec 2016 02:08:49 GMT

Hi @vivekb

Don't forget to resolve your question by clicking "Accept" below the answer you decided to go with!

Patrick

Re: How to edit my search to add row header labels to the table of results?

vivekb — Thu, 01 Dec 2016 11:50:24 GMT

Done. Thanks Patrick!

Re: How to edit my search to add row header labels to the table of results?

sundareshr — Thu, 01 Dec 2016 12:46:27 GMT

You could do searchid=round((now()-_time)/86400, 0)." days"