Good morning,
with the following search:
index="app_dynatrace" sourcetype="pa" application="Saipemcom Prod" "dimensions.Apdex performance zone for User Actions" !=unknown
| append [search index="app_dynatrace" sourcetype="visit" application="Saipemcom Prod"
| spath "dimensions.Visits - Geo Information" output=Country_visit]| spath "dimensions.Apdex performance zone for User Actions" output=Apdex_val|spath "dimensions.Country of Visits" output=Country1 | rex field=Country1 "(?\S+(\s\w))(\s+-)?"
|eval Country_useraction=trim(CountryS)|fields Country_useraction, Country_visit
I'd like a single output like:
Country Visit Useraction
Italy 800 1000
USA 100 123
.... .... .........
Many thanks for the support.
Regards
Antonio
Hi antoniofacchi,
I cannot replicate your search, but if you have the same output of both your searches, you can merge them, see this example:
index=index1
| stats count AS Total1 BY host
| append [ search index=index2 | stats count AS Total2 BY host ]
| stats values(Total1) AS Total1 values(Total2) AS Total2 BY host
It's important to have in both main and sub searches the same BY field and assign a name to each output (or outputs) of the stats command.
In this way you have on the same row values of Total1 and Total2 for each host.
Bye.
Giuseppe
Hi antoniofacchi,
I cannot replicate your search, but if you have the same output of both your searches, you can merge them, see this example:
index=index1
| stats count AS Total1 BY host
| append [ search index=index2 | stats count AS Total2 BY host ]
| stats values(Total1) AS Total1 values(Total2) AS Total2 BY host
It's important to have in both main and sub searches the same BY field and assign a name to each output (or outputs) of the stats command.
In this way you have on the same row values of Total1 and Total2 for each host.
Bye.
Giuseppe
Hi Giuseppe,
thank you for the suggestion,it works very well.
regards
Antonio
Hi Antonio,
if you're satisfied by this answer accept or upvote it.
Ciao.
Giuseppe
Hi antoniofacchi,
You can use join command to get the same output .. refer below link
http://docs.splunk.com/Documentation/Splunk/7.0.0/SearchReference/Join
HI anjambha,
thank you for the suggetion,it works very well.
regards
Antonio