Splunk Enterprise

How to create a search to join two query's for common values to populate results in table?

kc_prane
Communicator

 

 

"my base query 1 to  Total _count_of_sucess_transactions"
| rex "URI\s*(?<URI>[^\=\n]+)"
"my base query 2 to trackTotal _count_of_Failed_transactions" 
| rex "gov\^*(?<URL>.*)"

 

 

I want the below table to be shown


1)  column 1 Total count of Success transactions 

2)  column 2 Total count of Failed Services

3) column 3 Percent of success rate 

 

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Assuming the URI and URL fields contain the same values, you could try this

<<base query 1 to  Total_count_of_success_transactions>>
| rex "URI\s*(?<URL>[^\=\n]+)"
| append [ <<base query 2 to track Total_count_of_Failed_transactions>>
  | rex "gov\^*(?<URL>.*)"
| stats values(*) as * by URL
| eval pct=(Total_count_of_success_transactions*100)/(Total_count_of_success_transactions+Total_count_of_Failed_transactions)

If the URI and URL fields are similar, but slightly different then one of the queries will have to modify the field to be like the other.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

kc_prane
Communicator

Hi @richgalloway  Thanks for respnding i dont see the results as expected.

1) Yes the fileds in URI and URL are same but from different events

2)  i havent defined the  Total_count_of_sucess_transcations ( URI ) & Total_count_of_failed_transcations(URL) this info comes from the rex  in  the query.

 

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The rex commands in the original query appear to extract URLs, not numbers, but that's my assumption based on no sample data.

---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

Assuming the URI and URL fields contain the same values, you could try this

<<base query 1 to  Total_count_of_success_transactions>>
| rex "URI\s*(?<URL>[^\=\n]+)"
| append [ <<base query 2 to track Total_count_of_Failed_transactions>>
  | rex "gov\^*(?<URL>.*)"
| stats values(*) as * by URL
| eval pct=(Total_count_of_success_transactions*100)/(Total_count_of_success_transactions+Total_count_of_Failed_transactions)

If the URI and URL fields are similar, but slightly different then one of the queries will have to modify the field to be like the other.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...