Splunk Enterprise

How to create a search to join two query's for common values to populate results in table?

kc_prane
Path Finder

 

 

"my base query 1 to  Total _count_of_sucess_transactions"
| rex "URI\s*(?<URI>[^\=\n]+)"
"my base query 2 to trackTotal _count_of_Failed_transactions" 
| rex "gov\^*(?<URL>.*)"

 

 

I want the below table to be shown


1)  column 1 Total count of Success transactions 

2)  column 2 Total count of Failed Services

3) column 3 Percent of success rate 

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assuming the URI and URL fields contain the same values, you could try this

<<base query 1 to  Total_count_of_success_transactions>>
| rex "URI\s*(?<URL>[^\=\n]+)"
| append [ <<base query 2 to track Total_count_of_Failed_transactions>>
  | rex "gov\^*(?<URL>.*)"
| stats values(*) as * by URL
| eval pct=(Total_count_of_success_transactions*100)/(Total_count_of_success_transactions+Total_count_of_Failed_transactions)

If the URI and URL fields are similar, but slightly different then one of the queries will have to modify the field to be like the other.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

kc_prane
Path Finder

Hi @richgalloway  Thanks for respnding i dont see the results as expected.

1) Yes the fileds in URI and URL are same but from different events

2)  i havent defined the  Total_count_of_sucess_transcations ( URI ) & Total_count_of_failed_transcations(URL) this info comes from the rex  in  the query.

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rex commands in the original query appear to extract URLs, not numbers, but that's my assumption based on no sample data.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Assuming the URI and URL fields contain the same values, you could try this

<<base query 1 to  Total_count_of_success_transactions>>
| rex "URI\s*(?<URL>[^\=\n]+)"
| append [ <<base query 2 to track Total_count_of_Failed_transactions>>
  | rex "gov\^*(?<URL>.*)"
| stats values(*) as * by URL
| eval pct=(Total_count_of_success_transactions*100)/(Total_count_of_success_transactions+Total_count_of_Failed_transactions)

If the URI and URL fields are similar, but slightly different then one of the queries will have to modify the field to be like the other.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...