Combining two searches for purpose of table & stats

Barty — Tue, 06 Mar 2018 14:22:14 GMT

Good afternoon all,

Apologies for the below, my first question and also I'm a complete newbie to this. So, I have been asked by a user if it would be possible to combine two searches for the purpose of creating a table that has the resulting fields and also a stats count on one of the fields.

Let me explain. The two base searches are:-

Search 1:

index=our_index "Initialising journeyContext using initial request parameters:[AggregatorInitialRequest{aggregatorID" source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log"
| rex "\[[^\:]*\:(?<sessionId>.*)\:\:\:M6.*aggregatorID\=\'(?<aggId>[^\']*)"
| table sessionId aggId

Search 2

index=our_index source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log" 
| rex "\[[^\:]*\:(?<sessionId>[^\:]*)\:(?<requestId>[^\:]*)" 
| dedup requestId 
| stats count as counter by sessionId

What the end user would like is a table that has sessionId | aggId | count

Now I have played around trying to use the join command on sessionId, but to no avail and it's absolutely killing me. I've got as far as trying this, but no results are returning:-

index=our_index "Initialising journeyContext using initial request parameters:[AggregatorInitialRequest{aggregatorID" source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log"
| rex "\[[^\:]*\:(?<sessionId>.*)\:\:\:M6.*aggregatorID\=\'(?<aggId>[^\']*)"
| join sessionId 
    [search index=app_qnb earliest=-10m source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log" | rex "\[[^\:]*\:(?<sessionId>[^\:]*)\:(?<requestId>[^\:]*)"]
| table sessionId

I was hoping i could at leats get as far as the combination of both sessionId results, but no such luck. I'm turning to you guys as I know someone out there is going to hopefully show how to do this quickly, easily and far less complicated than I am making it! Oh, and it's v6.6.4 if that helps.

Help me Obi-splunk_kenobi, you're my only hope

Re: Combining two searches for purpose of table & stats

somesoni2 — Tue, 06 Mar 2018 15:34:14 GMT

Give this a try..

 index=our_index source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log"
| rex "\[[^\:]*\:(?<sessionId>[^\:]*)"
| rex "\[[^\:]*\:(.*)\:\:\:M6.*aggregatorID\=\'(?<aggId>[^\']*)"
| rex "\[[^\:]*\:([^\:]*)\:(?<requestId>[^\:]*)" 
| stats values(aggId) as aggId dc(requestId) as counter by sessionId

Re: Combining two searches for purpose of table & stats

Barty — Wed, 07 Mar 2018 08:41:35 GMT

Seems to have worked a charm! Thank you

topic Re: Combining two searches for purpose of table & stats in Splunk Search

Combining two searches for purpose of table & stats

Re: Combining two searches for purpose of table & stats

Re: Combining two searches for purpose of table & stats