Splunk Search

Combine column values and search

chiilii
Explorer

I have a dynamic table extracted from a search result. Example Table1 that I can get:

ErrorCodeComputer
Internet Connection100CompA
Blue Screen CompB
App Crash5CompC

 

My desired result:
For each row in the Table1, I would like to join the columns and make multisearch as below.

 

 

index=computer OR index=application (Internet Connection AND 100 AND CompA) | tail 1
index=computer OR index=application (Blue Screen AND CompB) | tail 1
index=computer OR index=application (App Crash AND 5 AND CompC) | tail 1 

 

 

I didn't use format in this case because it would end up like..

 

 

index=computer OR index=application ( (Internet Connection AND 100 AND CompA) OR (Blue SCreen AND CompB) OR (App Crash AND 5 AND CompC) )

 

 

and returns many result instead of only 3 results.

Is the desired result possible to achieve?

Labels (3)
Tags (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @chiilii 

You have to extract fields required Error, code and computer for _raw events first and apply | table command should show you  the output required.

How is your original events looks like?

0 Karma

chiilii
Explorer

Hi @venkatasri 

Thanks for looking at this. I am able to get the table but not able to break the table into this:

index=computer OR index=application (Internet Connection AND 100 AND CompA) | tail 1
index=computer OR index=application (Blue Screen AND CompB) | tail 1
index=computer OR index=application (App Crash AND 5 AND CompC) | tail 1

 

Tags (1)
0 Karma

venkatasri
SplunkTrust
SplunkTrust

what you are trying to achieve?  | tail=1 is not a valid command.

0 Karma

chiilii
Explorer

Sorry have updated the tail and my post too. Hope it is more understandable

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Community Content Calendar, October Edition

Welcome to the October edition of our Community Spotlight! The Splunk Community is a treasure trove of ...

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...