Getting Data In

Search with three Index with different fields

jaciro11
Path Finder

Hello Splunk TEAM,

I have a question about my searchs in splunk.

I have 3 index and I want to search and compare some information. 

But when I do my search Tiempo_Ejecutado its wrong I dont know what happen!

 

(index="inlooxtt" StatusName!=Completed StatusName!=Cancelled PerformedByName!=Donado* CreatedDate>2020-05-30 ProjectName!="Capac* General" ProjectName!="Preventas*") OR (index="inlooxtasks" ProjectStatusName!=Completed ProjectStatusName!=Cancelled ContactDisplayName!=Donado* ContactDisplayName!="null" ProjectName!="Capac* General" ProjectName!="Preventas*") OR (index="inlooxprojects" StatusName!="Completed" StatusName!="Cancelled" StatusName!="Pausado" IsRecycled!="true" FirstTeamMember!="Inloox - Alejandro Donado (deleted)" Name!="Capacit* General" Name!=Preventas*)
| eval Proyectos=coalesce(ProjectName, Name) 
| eval Tiempo_Ejecutado=(DurationMinutes/60), Tiempo_Planeado=WorkAmount, Tiempo_Vendido=Ventas
| stats dedup_splitvals=true sum(Tiempo_Ejecutado) as Tiempo_Ejecutado, sum(Tiempo_Planeado) as Tiempo_Planeado, sum(Tiempo_Vendido) as Tiempo_Vendido by Proyectos
| eval Tiempo_Ejecutado=round(Tiempo_Ejecutado,2)
| eval Tiempo_Planeado=round(Tiempo_Planeado,2)
| sort Proyectos

 

 

Index1 have ProjectName Index2 ProjectName Index Name

Compare.png

Thanks ALL!

Labels (2)
Tags (1)
0 Karma
1 Solution

jaciro11
Path Finder

My problem is: 

CreatedDate>2020-05-30

Sorry all and thanks!!! 🙂 

View solution in original post

0 Karma

jaciro11
Path Finder

My problem is: 

CreatedDate>2020-05-30

Sorry all and thanks!!! 🙂 

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...