All Apps and Add-ons
Highlighted

Can Splunk Join between 2 Unions?

Builder

I have 2 searches with set union and i need to join between those 2 results on a specific column (origine)
can i join between 2 set union search ,if yes how?

Search 1:
| set union [search sourcetype="log4j" | rex field=source "/././(?.)_(?.)(?.*).log"
| stats count by SEVERITY
WEBAPP, origine
| where SEVERITYWEBAPP="ERROR" OR SEVERITYWEBAPP="FATAL" OR SEVERITYWEBAPP="WARN" | rename SEVERITYWEBAPP as SEVERITY]
[search source="/home/splunk/app4errorcore.log" | rex field=source "/././(?.)_(?.)(?.*).log" | stats count by SEVERITYCORE , origine
| where SEVERITYCORE="ERROR" OR SEVERITYCORE="FATAL" OR SEVERITYCORE="WARN" | rename SEVERITYCORE as SEVERITY ]

Search 2:
| set union [search sourcetype="log4j" | rex field=source "/././(?.)_(?.)(?.*).log"
| top limit=1 COMPONENTS
WEB by SEVERITYWEBAPP, origine
| where SEVERITY
WEBAPP="ERROR" OR SEVERITYWEBAPP="FATAL" OR SEVERITYWEBAPP="WARN" | rename SEVERITYWEBAPP as SEVERITY | rename COMPONENTSWEB as COMPONENTS]
[search source="/home/splunk/app4errorcore.log" | rex field=source "/././(?.)_(?.)(?.*).log" | top limit=1 COMPONENTSCORE by SEVERITYCORE , origine
| where SEVERITY
CORE="ERROR" OR SEVERITYCORE="FATAL" OR SEVERITYCORE="WARN" | rename SEVERITYCORE as SEVERITY | rename COMPONENTSCORE as COMPONENTS]

0 Karma
Highlighted

Re: Can Splunk Join between 2 Unions?

SplunkTrust
SplunkTrust

Sure:

| set union [stats count | eval foo = 1] [stats count | eval foo = 1] | join count [set union [stats count | eval bar = 1] [stats count | eval bar = 1]]

View solution in original post

0 Karma
Highlighted

Re: Can Splunk Join between 2 Unions?

Builder

The Solution is then:

| set union [search sourcetype="log4j" | rex field=source "/././(?.)_(?.)(?.*).log"
| stats count by SEVERITY
WEBAPP, origine
| where SEVERITYWEBAPP="ERROR" OR SEVERITYWEBAPP="FATAL" OR SEVERITYWEBAPP="WARN" | rename SEVERITYWEBAPP as SEVERITY]
[search source="/home/splunk/app4errorcore.log" | rex field=source "/././(?.)_(?.)(?.*).log" | stats count by SEVERITYCORE , origine
| where SEVERITYCORE="ERROR" OR SEVERITYCORE="FATAL" OR SEVERITYCORE="WARN" | rename SEVERITYCORE as SEVERITY ]

| JOIN left outer origine,SEVERITY

[ set union [search sourcetype="log4j" | rex field=source "/././(?.)_(?.)(?.*).log"
| top limit=1 COMPONENTS
WEB by SEVERITYWEBAPP, origine
| where SEVERITY
WEBAPP="ERROR" OR SEVERITYWEBAPP="FATAL" OR SEVERITYWEBAPP="WARN" | rename SEVERITYWEBAPP as SEVERITY | rename COMPONENTSWEB as "TOP COMPONENTS"]
[search source="/home/splunk/app4errorcore.log" | rex field=source "/././(?.)_(?.)(?.*).log" | top limit=1 COMPONENTSCORE by SEVERITYCORE , origine
| where SEVERITY
CORE="ERROR" OR SEVERITYCORE="FATAL" OR SEVERITYCORE="WARN" | rename SEVERITYCORE as SEVERITY | rename COMPONENTSCORE as "TOP COMPONENTS"] ]

0 Karma
Highlighted

Re: Can Splunk Join between 2 Unions?

SplunkTrust
SplunkTrust

A more general thought, you may be able to pull the where SEVERITY_WEBAPP=somethingsomething part into the main searches, potentially improving performance. The earlier you can let splunk ignore events the less it needs to load off the disks and process.

0 Karma
Highlighted

Re: Can Splunk Join between 2 Unions?

Builder

Thanks dude!

0 Karma