Splunk Search

Combining 2 Queries Using Same Field

PaintItParker
Explorer

I have two queries. One gets the total number of events using the message field:

 

index=my_index sourcetype=my_sourcetype
| stats count(message) AS TotalA
| table TotalA

 

And the other uses multiple regex statements and the message field to get the total number of errors:

 

index=my_index sourcetype=my_sourcetype
| regex message = "(?:(^Problem.*)|((?i).*Issue.*)|((?i).*Error.*))"
| stats count(message) AS TotalB
| table TotalB

 

My goal is to have TotalA and TotalB side by side in a table. I would then like to divide TotalA by TotalB to get a ratio and display that alongside TotalA and TotalB in the table.

How could I go about combining these? Thanks!

Labels (4)
0 Karma
1 Solution

ericjorgensenjr
Path Finder

This should work:

 

index=my_index sourcetype=my_sourcetype 
| eval isProblem=if(match(message,"(?i)(?:problem)|(?:issue)|(?:error)"),1,0) 
| stats count as totalMessage, sum(isProblem) as countErrors
| eval ratioErrors = round(countErrors/totalMessage,4)

 

 

View solution in original post

ericjorgensenjr
Path Finder

This should work:

 

index=my_index sourcetype=my_sourcetype 
| eval isProblem=if(match(message,"(?i)(?:problem)|(?:issue)|(?:error)"),1,0) 
| stats count as totalMessage, sum(isProblem) as countErrors
| eval ratioErrors = round(countErrors/totalMessage,4)

 

 

PaintItParker
Explorer

Thank you so much!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...