Splunk Search

Combine column values and search

chiilii
Explorer

I have a dynamic table extracted from a search result. Example Table1 that I can get:

ErrorCodeComputer
Internet Connection100CompA
Blue Screen CompB
App Crash5CompC

 

My desired result:
For each row in the Table1, I would like to join the columns and make multisearch as below.

 

 

index=computer OR index=application (Internet Connection AND 100 AND CompA) | tail 1
index=computer OR index=application (Blue Screen AND CompB) | tail 1
index=computer OR index=application (App Crash AND 5 AND CompC) | tail 1 

 

 

I didn't use format in this case because it would end up like..

 

 

index=computer OR index=application ( (Internet Connection AND 100 AND CompA) OR (Blue SCreen AND CompB) OR (App Crash AND 5 AND CompC) )

 

 

and returns many result instead of only 3 results.

Is the desired result possible to achieve?

Labels (3)
Tags (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @chiilii 

You have to extract fields required Error, code and computer for _raw events first and apply | table command should show you  the output required.

How is your original events looks like?

0 Karma

chiilii
Explorer

Hi @venkatasri 

Thanks for looking at this. I am able to get the table but not able to break the table into this:

index=computer OR index=application (Internet Connection AND 100 AND CompA) | tail 1
index=computer OR index=application (Blue Screen AND CompB) | tail 1
index=computer OR index=application (App Crash AND 5 AND CompC) | tail 1

 

Tags (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

what you are trying to achieve?  | tail=1 is not a valid command.

0 Karma

chiilii
Explorer

Sorry have updated the tail and my post too. Hope it is more understandable

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!