Splunk Query

bapun18 · ‎08-26-2020

Hi ,

Below is the existing query but when i run this for a single index with its fields i get the statistics data & count but when i am trying to run all these 4 -indexes and it's respective fields together i am not getting any Statistical table as output what changes do i need to make to list out all 4 indexes with their respective count in statistics. ..(For single index and it's fields it's working fine but when i try to merge all 4 index details it's statistics value is 0 as you can see below.)

isoutamo · ‎08-26-2020

You should use (index....) OR (index....) ... otherwise your logic could be wron as you have ORs and ANDs in your base query.

r. Ismo

Splunk Query

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

Join the Conversation

Splunk Query

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Announcing Modern Navigation: A New Era of Splunk User Experience

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...