Splunk Search

Append multiple searches and sort the result set with no repeated rows

lpolo
Motivator

I have the following Splunk search query that is working fine:

sourcetype="x"
"ABC" NOT D|
lookup rr_by_dd dd as dd OUTPUT rr as rr 
|stats DC(MAC) as Unique_Number_O by rr

|append 
[ search
  sourcetype="x"
  "ABC" AND D|
  lookup rr_by_dd dd as dd OUTPUT rr as rr 
|stats DC(MAC) as Unique_Number_T by rr]

|append 
[ search
  sourcetype="x"
  "ABC"|
  lookup rr_by_dd dd as dd OUTPUT rr as rr 
|stats DC(MAC) as Unique_Number_B by rr]

I get the following Result set:

rr  Unique_Number_O
house   120
APT 90

rr  Unique_Number_T
house   100
APT 60

rr  Unique_Number_B
house   80
APT 30

I would like to get the result set as follow:

rr  Unique_Number_O Unique_Number_T Unique_Number_B
house   120     100     80
APT 90      60      30

I have been not able to get the query to obtain the result set sorted out as I want.

Any ideas will be appreciated.

Thanks,
Lp

Tags (1)
0 Karma

lpolo
Motivator

But now I have the issue of subsearch limits. This is a Karma ;-).

0 Karma

lpolo
Motivator

by replacing append to appendcols solved my issue.

Thanks,
Lp

Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...