Splunk Search

Append multiple searches and sort the result set with no repeated rows

Motivator

I have the following Splunk search query that is working fine:

sourcetype="x"
"ABC" NOT D|
lookup rr_by_dd dd as dd OUTPUT rr as rr 
|stats DC(MAC) as Unique_Number_O by rr

|append 
[ search
  sourcetype="x"
  "ABC" AND D|
  lookup rr_by_dd dd as dd OUTPUT rr as rr 
|stats DC(MAC) as Unique_Number_T by rr]

|append 
[ search
  sourcetype="x"
  "ABC"|
  lookup rr_by_dd dd as dd OUTPUT rr as rr 
|stats DC(MAC) as Unique_Number_B by rr]

I get the following Result set:

rr  Unique_Number_O
house   120
APT 90

rr  Unique_Number_T
house   100
APT 60

rr  Unique_Number_B
house   80
APT 30

I would like to get the result set as follow:

rr  Unique_Number_O Unique_Number_T Unique_Number_B
house   120     100     80
APT 90      60      30

I have been not able to get the query to obtain the result set sorted out as I want.

Any ideas will be appreciated.

Thanks,
Lp

Tags (1)
0 Karma

Motivator

But now I have the issue of subsearch limits. This is a Karma ;-).

0 Karma

Motivator

by replacing append to appendcols solved my issue.

Thanks,
Lp