Splunk Search

Combine 3 queries into tabular form for export to .csv

shrogers
Loves-to-Learn Everything

Hi All,

Need some assistance combining 3 queries in tabular form so I can export them to a lookup table.
I'm also trying to add a date range
Example - On 2021-02-18 morning we report metrics from  2021-02-16 5:00 PM to 2021-02-17 5:00 PM

Q1:
index=tst1 sourcetype IN (tst2, tst4, tst5) source IN ("/opt/performance.log", "/opt/formance.log", "/opt/test.log") | fields TRAN_TYPE, respTime, TRAN_TIME_MS |stats count as Total, count(eval(TRAN_TIME_MS<=3000)) as Total_Under_3sec1 ,count(eval(respTime<=3000)) as Total_Under_3sec2 | addtotals fieldname="Total_Under_3sec" Total_Under_3sec1 Total_Under_3sec2 | eval Perc = (Total_Under_3sec / Total)*100 |fields Perc

Q2:
index=tst2 sourcetype=tst2 PAGE_ID_WEIGHT=* TRAN_TYPE =* PAGE_ID=345 ACTION=GET | eval USER_ID=lower(USER_ID) | stats dc(USER_ID)

Q3:
index=tst3 sourcetype=test3 method=POST login=/tst3* user!=unauthenticated msgCode=302 | eval action=case(status==302,"Success") | stats dc(user)

Col1    Col2      Col3
99        89         97

Any assistance is appreciated.

0 Karma

saravanan90
Contributor

Great !!

Appreciate if you could accept as solution....:)

0 Karma

saravanan90
Contributor

This may help...

Query 1 | appendcols [ search Query2] | appendcols [search query3]

e.g:  index=_internal | stats count as col1 | appendcols [search index=_introspection | stats count as col2] | appendcols [search index=_audit | stats count as col3]

0 Karma

shrogers
Loves-to-Learn Everything

Thank you for your quick response.

It works as expected.

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...