Getting Data In

How to combine multiple searches and output results into one CSV file?

mendesjo
Path Finder

Here is example query..

index=A host=host1 | stats count by host 
| index=B sourcetype=s1 | dedup host | table host 
| index=C sourcetype=s2 | dedup host | table host 
| outputcsv output_file_name

Individually, these queries work, but in a perfect world I'd like to run the queries as one to produce the outputs into one single CSV. Possible? Running the searches separately and appending to same CSV file is fine also.

0 Karma
1 Solution

gokadroid
Motivator

how about using append

index=A host=host1 | stats count by host 
|append [ search  index=B sourcetype=s1 | dedup host | table host ]
|append [ search  index=C sourcetype=s2 | dedup host | table host ]
| outputcsv output_file_name

For details on append see here

View solution in original post

gokadroid
Motivator

how about using append

index=A host=host1 | stats count by host 
|append [ search  index=B sourcetype=s1 | dedup host | table host ]
|append [ search  index=C sourcetype=s2 | dedup host | table host ]
| outputcsv output_file_name

For details on append see here

mendesjo
Path Finder

Thank you for the suggestion, wow that works!

0 Karma

somesoni2
Revered Legend

Try these

(index=A host=host1) OR (index=B sourcetype=s1) OR (index=C sourcetype=s2)
| stats count by host | outputcsv output_file_name

If you don't want count field for index=B and index=C, try this

(index=A host=host1) OR (index=B sourcetype=s1) OR (index=C sourcetype=s2)
| stats count by host | eval count=if(host="host1",count,null())| outputcsv output_file_name

mendesjo
Path Finder

Thank you for the suggestion, you are correct with your 2nd suggestion I didn't want to count them and I find the append command easier to work with. Thanks again, totally forgot that OR will do it as well. Thanks again!

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...