Splunk Search

Combine 2 Splunk queries

nishil
New Member

I have 2 splunk searches:

First:

This extracts whats the URLs in column 10 and unique counts the URLs

sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access*.log | rex field=_raw "(?i)^(?:[^ ]* ){10}(?P<URL>[^ ]+)" | stats count by URL

Second:

This counts the occurences of dealswidget or hotelquerywidget

sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access*.log "dealswidget" OR "hotelquerywidget" | rex "(?<myword>dealswidget|hotelquerywidget)" | stats count by myword

Now i would like to combine the two serches so that i get a count of dealswidget" OR hotelquerywidget (from the second search) and then a count of unique URLs (from the first search).

Any ideas? Simply piping one search to the other dont work.

Thanks for the assitance.

Tags (1)
0 Karma

jrwilk01
Explorer

I'm not completly sure I understand what you are asking for, but I have an idea. If I miss, post a mocked up example of what you expect your results table to look like.

I think you are looking for the "append" search command.

Try this:

sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access*.log "dealswidget" OR "hotelquerywidget" | rex "(?<myword>dealswidget|hotelquerywidget)" | stats count by myword | append [sourcetype=hwa_other source=/var/tomcat/servers/HAP01/logs/tomcat_access.log | rex field=_raw "(?i)^(?:[^ ] ){10}(?P<url>[^ ]+)" | stats count by URL]
0 Karma

Ledion_Bitincka
Splunk Employee
Splunk Employee

You can use the append search command as follows:

..... | stats count BY URL | append [..... | stats count BY myword]

alancalvitti
Path Finder

When the prefix query ( .....) is long, is there a way to assign that to an identifier so it can be referenced more than once?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...