Splunk Search

Add Secondary search variable in primary search

rahulmittal2391
New Member

rahulmittal2391_0-1719311265868.png

index="ss-stg-dkp" cluster_name="*" AND namespace=dcx AND (label_app="composite-*" ) sourcetype="kube:container:main" | rex \"status\":"(?<Http_code>\d+)" | rex \"evtType\":"\"(?<evt_type>\w+)"\" |search evt_type=REQUEST| stats count(eval(Http_code>0)) as "Totalhits" count(eval(Http_code <500)) as "sR"| append [ search index="ss-stg-dkp" cluster_name="*" AND namespace=dcx AND (label_app="composite-*" ) sourcetype="kube:container:main"| rex field=_raw "Status code:"\s(?<code>\d+) |stats count(eval(code =500)) as error]

 

Hi All I want to add error count in to Totalhits

like eval TotalRequest = error+TotalHits

rahulmittal2391_1-1719311491042.png

It is showing as null value. Please help me to achieve this

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="ss-stg-dkp" cluster_name="*" AND namespace=dcx AND (label_app="composite-*" ) sourcetype="kube:container:main" | rex \"status\":"(?<Http_code>\d+)" | rex \"evtType\":"\"(?<evt_type>\w+)"\" | rex field=_raw "Status code:"\s(?<code>\d+) | stats count(eval(Http_code>0 AND evt_type="REQUEST")) as "Totalhits" count(eval(Http_code <500 AND evt_type="REQUEST")) as "sR" count(eval(code =500)) as error
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...