Splunk Search

Combining these multiple queries into one

vhwang
New Member

I have a list of channels that I want to query, and for each one, I'd like to retrieve the latest value. For example

chan_name=B-1111 | head 1 | table _time, dn
chan_name=B-1112 | head 1 | table _time, dn
chan_name=B-1113 | head 1 | table _time, dn
chan_name=B-1114 | head 1 | table _time, dn

What's the best way to combine this query so that it shows up neatly in a table (and ultimately JSON object)?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You could use stats:

chan_name=* | stats first(dn),first(_time) by chan_name

Or dedup:

chan_name=* | dedup chan_name | table _time,dn

View solution in original post

0 Karma

williamche
Path Finder

To add to Ayn's answers:

You can create a new eventtype using the following query:

chan_name=B-1111 OR chan_name=B-1112 OR chan_name=B-1113 OR chan_name=B-1113

Then pipe the results of this new eventtype to dedup or stats. So the new query would look something like:

eventtype=channel_names | dedup chan_name | table _time,dn

Should you need to modify the list of channel names to include in the query, you can do it at the eventtype level.

Ayn
Legend

You could use stats:

chan_name=* | stats first(dn),first(_time) by chan_name

Or dedup:

chan_name=* | dedup chan_name | table _time,dn
0 Karma

Ayn
Legend

chan_name=B-1111 OR chan_name=B-1112 OR. ..

0 Karma

vhwang
New Member

I don't want to do all the chan_names, just an inputted list. Is there a way to do something like

chan_name=['B-1111, B-1112']
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...