Can you help me with a complex subsearch?

[jip31]

Hi

I use the request below in order to count degradation stop performances by service name

index="windows" sourcetype="wineventlog:microsoft-windows-diagnostics-performance/operational" Type=* OpCode="Détérioration de l’arrêt" TaskCategory="Analyse des performances d’arrêt" Nom_du_fichier=* "Durée de la dégradation"=* 
 | stats dc(Durée de la dégradation) as Total by Nom_du_fichier | sort -Total limit=10

You can see the result here

https://cjoint.com/c/IAdiC08SQZd

Now, I want to match these requests with this one :

index="windows-fr" sourcetype=WinRegistry key_path=\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry | eval NATCO=if(key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data, null)
| stats values(NATCO) as NATCO by host 
| stats dc(host) as host by NATCO | sort -NATCO limit=10

My goal is to count degradation stop performances by service name and by NATCO.

So, I would like to have in a same table the same thing that there is in the capture but also with a NATCO column.

Could you help me please??

[raphgoncalves]

Just in case someone come over this question, I suggested OP to use "Join" Command : https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join

He came up with the following search

index="windows" sourcetype="wineventlog:microsoft-windows-diagnostics-performance/operational" Type=* OpCode="Détérioration de l’arrêt" TaskCategory="Analyse des performances d’arrêt" Nom_du_fichier=* "Durée de la dégradation"=* | stats count by host   
 | join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry"  | eval NATCO=if(key_path=="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data, null) | stats latest(NATCO) as NATCO by host]
 | stats values(NATCO) as NATCO by host | stats count as Total by NATCO
 | sort -Total limit=10

[raphgoncalves]

If you have a common ID, you could use "join" command : https://docs.splunk.com/Documentation/Splunk/7.2.0/SearchReference/Join

[jip31]

I dont succeed...

[raphgoncalves]

Maybe I could help if you give events sample for your requests

[jip31]

I have done this

index="windows" sourcetype="wineventlog:microsoft-windows-diagnostics-performance/operational" Type=* OpCode="Détérioration de l’arrêt" TaskCategory="Analyse des performances d’arrêt" Nom_du_fichier=* "Durée de la dégradation"=* | stats count by host   
| join host [search index=windows sourcetype=winregistry key_path="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry"  | eval NATCO=if(key_path=="\\registry\\machine\\software\\wow6432node\\xx\\master\\ConfigurationCountry",data, null) | stats latest(NATCO) as NATCO by host]
| stats values(NATCO) as NATCO by host | stats count as Total by NATCO
| sort -Total limit=10

[raphgoncalves]

so you have a common id 😉
Great to know that it helped 🙂

[jip31]

thanks!!!!

[jip31]

And no commun ID..