Combining 2 splunks and displaying count

[bmer]

Hello,

I have 2 seperate splunks as below . One is "v1 endpoint" and other is "v2 endpoint"

v1 endpoint: index="abc" "usr*" organizationId=xxxx "`DLQuery`DLQuery`POST`"
v2 endpoint: index="abc" "usr*" organizationId=xxxx "DLQuery" "DLSqlQueryV2"

I want to create 1 single splunk which will give me v1, v2 count over a span using timechart function.How do we combine them to achieve the output?

Thanks,

bmer

[gcusello]

Hi @bmer ,

just some additional information:

what's your purpose: find the count of occurrances or list all the events?

what are the backthicks between quotes?

I suppose that between quotes you have strings to search and the you want to count the occurrences for each organizationId.

In this case, there are many way to reach your purpose, but the most efficient is stats:

index="abc" "usr*" ("`DLQuery`DLQuery`POST`" OR ("DLQuery" "DLSqlQueryV2"))
| stats count BY organizationId

Ciao.

Giuseppe

[bmer]

@gcusello I want to count the list of occurrence of events coming in splunk 1 and splunk 2 seperately

I suppose that between quotes you have strings to search and the you want to count the occurrences for each organizationId. : First part of your statement is correct BUT I do not want to aggregate by organizationId.It is common for BOTH splunk. The "`DLQuery`DLQuery`POST`" is part of all events related to v1 whereas "DLQuery" "DLSqlQueryV2" is all events related to v2. So at the EOD I want to know daywise v1 and v2 count

[gcusello]

Hi @bmer ,

ok,you want only organizationIDs that are common to both the searches that have the same index and user*.

in this case you have to use my search with an additional clause:

index="abc" "usr*" ("`DLQuery`DLQuery`POST`" OR ("DLQuery" "DLSqlQueryV2"))
| eval type=if(searchmatch("`DLQuery`DLQuery`POST`"), "v1", "v2")
| stats dc(type) AS type_count count BY organizationId
| where type_count>1

in this way you have only the events that match bpth the searches.

Ciao.

Giuseppe