Splunk Search

SPLUNK Query to combine two coloums as per the search string

bvsuman
New Member

Am using two Queries using appendcols to get the data . Sample data is as follows

Classification | Name | Basket1 |Basket2 | Basket1+2
Fruit | Mango | aa |xx |aaxx
Fruit | Apple |bb |yy |bbyy
Fruit | Banana |cc |zz | cczz
Fruit | Pineapple |dd |uu |dduu

In basket 1 sequence of fruits is Mango, Apple, Bananna, Pineapple whereas the sequence of Basket2 is Bananna( zz),Mango(uu), Apple(yy),pineapple(xx)

As per my requirement the result will be like below

Classification |Name| Basket1 | Basket2 | Basket1+2
Fruit |Mango|aa |uu |aauu
Fruit | Apple |bb|yy| bbyy
Fruit|Banana |cc |zz |cczz
Fruit|Pineapple| dd| xx|ddxx

Tags (1)
0 Karma

bvsuman
New Member

So please help me

0 Karma

bvsuman
New Member

sourcetype="st-offline-orders" NonContinuableError earliest=-48h@h latest=-24h@h |rex field=_raw "NonContinuableError:(?<NCE>.?)|DN" |search NCE NOT (:CON-* OR :CUST OR loginError) | eval Hour=strftime(_time, "%H") | chart count over NCE by Day | addtotals | sort 0 -Total |lookup local=true "FileName" NON_CONTINUABLE_ERROR as NCE OUTPUT CLASSIFICATION as Classification | where Classification="FRUIT" |table Classification NCE Total * | addcoltotals | rename "Total" as "Basket1" |appendcols [search sourcetype="st-online-orders" earliest=-48h@h latest=-24h@h NonContinuableError |rex field=_raw "NonContinuableError:(?<NCE>.?)|DN" |search NCE NOT (:CON-* OR :CUST OR loginError) | eval Hour=strftime(_time, "%H") | chart count over NCE by Day| addtotals | sort 0 -Total |lookup local=true "FileName1" NON_CONTINUABLE_ERROR as NCE OUTPUT CLASSIFICATION as Classification | where Classification="FRUIT" |table Classification NCE Total * | addcoltotals |rename "Total" as "Basket2"]| fields - NULL | eval Basket1+2=Basket1 + Basket2

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@bvsuman
Can you please share your both sample searches ??

0 Karma

bvsuman
New Member

sourcetype="st-offline-orders" NonContinuableError earliest=-48h@h latest=-24h@h |rex field=_raw "NonContinuableError:(?.?)|DN" |search NCE NOT (:CON- OR :CUST* OR loginError) | eval Hour=strftime(_time, "%H") | chart count over NCE by Day | addtotals | sort 0 -Total |lookup local=true "FileName" NON_CONTINUABLE_ERROR as NCE OUTPUT CLASSIFICATION as Classification | where Classification="FRUIT" |table Classification NCE Total | addcoltotals | rename "Total" as "Basket1" |appendcols [search sourcetype="st-online-orders" earliest=-48h@h latest=-24h@h NonContinuableError |rex field=_raw "NonContinuableError:(?.?)|DN" |search NCE NOT (:CON- OR :CUST OR loginError) | eval Hour=strftime(_time, "%H") | chart count over NCE by Day| addtotals | sort 0 -Total |lookup local=true "FileName1" NON_CONTINUABLE_ERROR as NCE OUTPUT CLASSIFICATION as Classification | where Classification="FRUIT" |table Classification NCE Total * | addcoltotals |rename "Total" as "Basket2"]| fields - NULL | eval Basket1+2=Basket1 + Basket2

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...