Splunk Search

Combine 2 Splunk queries

nishil
New Member

I have 2 splunk searches:

First:

This extracts whats the URLs in column 10 and unique counts the URLs

sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access*.log | rex field=_raw "(?i)^(?:[^ ]* ){10}(?P<URL>[^ ]+)" | stats count by URL

Second:

This counts the occurences of dealswidget or hotelquerywidget

sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access*.log "dealswidget" OR "hotelquerywidget" | rex "(?<myword>dealswidget|hotelquerywidget)" | stats count by myword

Now i would like to combine the two serches so that i get a count of dealswidget" OR hotelquerywidget (from the second search) and then a count of unique URLs (from the first search).

Any ideas? Simply piping one search to the other dont work.

Thanks for the assitance.

Tags (1)
0 Karma

jrwilk01
Explorer

I'm not completly sure I understand what you are asking for, but I have an idea. If I miss, post a mocked up example of what you expect your results table to look like.

I think you are looking for the "append" search command.

Try this:

sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access*.log "dealswidget" OR "hotelquerywidget" | rex "(?<myword>dealswidget|hotelquerywidget)" | stats count by myword | append [sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access.log | rex field=_raw "(?i)^(?:[^ ] ){10}(?P<url>[^ ]+)" | stats count by URL]
0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

You can use the append search command as follows:

..... | stats count BY URL | append [..... | stats count BY myword]

alancalvitti
Path Finder

When the prefix query ( .....) is long, is there a way to assign that to an identifier so it can be referenced more than once?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...