Splunk Search

Combining these multiple queries into one

vhwang
New Member

I have a list of channels that I want to query, and for each one, I'd like to retrieve the latest value. For example

chan_name=B-1111 | head 1 | table _time, dn
chan_name=B-1112 | head 1 | table _time, dn
chan_name=B-1113 | head 1 | table _time, dn
chan_name=B-1114 | head 1 | table _time, dn

What's the best way to combine this query so that it shows up neatly in a table (and ultimately JSON object)?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You could use stats:

chan_name=* | stats first(dn),first(_time) by chan_name

Or dedup:

chan_name=* | dedup chan_name | table _time,dn

View solution in original post

0 Karma

williamche
Path Finder

To add to Ayn's answers:

You can create a new eventtype using the following query:

chan_name=B-1111 OR chan_name=B-1112 OR chan_name=B-1113 OR chan_name=B-1113

Then pipe the results of this new eventtype to dedup or stats. So the new query would look something like:

eventtype=channel_names | dedup chan_name | table _time,dn

Should you need to modify the list of channel names to include in the query, you can do it at the eventtype level.

Ayn
Legend

You could use stats:

chan_name=* | stats first(dn),first(_time) by chan_name

Or dedup:

chan_name=* | dedup chan_name | table _time,dn
0 Karma

Ayn
Legend

chan_name=B-1111 OR chan_name=B-1112 OR. ..

0 Karma

vhwang
New Member

I don't want to do all the chan_names, just an inputted list. Is there a way to do something like

chan_name=['B-1111, B-1112']
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...