Splunk Search

Correlation using OR ?

sbnoobbb
Path Finder

I have used this search command to display timechart and I need to search between two sourcetype and return the specific location from sourcetype="CurrentWeatherSGTraffic" but it returns me all the location even from sourcetype="ltaTraffic". How can I return location only from sourcetype="CurrentWeatherSGTraffic". (note that sourcetype="CurrentWeatherSGTraffic" has the location extracted and is the same as sourcetype="ltaTraffic")

sourcetype="CurrentWeatherSGTraffic" OR sourcetype="ltaTraffic" | timechart count(eval(current_summary="Partly Cloudy")) as Cloudy , count(eval(Type=="Accident")) as Ancident by Location

alt text

Tags (2)
1 Solution

Ayn
Legend

If ItaTraffic contains many more locations than the only 6 from CurrentWeatherSGTraffic you care about, my advice would be to create a filter for these using a subsearch.

sourcetype="CurrentWeatherSGTraffic" OR sourcetype=ltaTraffic [search sourcetype="CurrentWeatherSGTraffic" | dedup Location | fields Location] | timechart count(eval(current_summary="Partly Cloudy")) as Cloudy , count(eval(Type=="Accident")) as Accident by Location

This will add the Location values from CurrentWeatherSGTraffic as a filter string in your search.

View solution in original post

Ayn
Legend

If ItaTraffic contains many more locations than the only 6 from CurrentWeatherSGTraffic you care about, my advice would be to create a filter for these using a subsearch.

sourcetype="CurrentWeatherSGTraffic" OR sourcetype=ltaTraffic [search sourcetype="CurrentWeatherSGTraffic" | dedup Location | fields Location] | timechart count(eval(current_summary="Partly Cloudy")) as Cloudy , count(eval(Type=="Accident")) as Accident by Location

This will add the Location values from CurrentWeatherSGTraffic as a filter string in your search.

sbnoobbb
Path Finder

Thanks you are right ! 😃

0 Karma

Drainy
Champion

Brackets should do the trick;

(sourcetype="CurrentWeatherSGTraffic" Location=*) OR (sourcetype=ltaTraffic NOT Location=*)

But, how will you do a By Location in the timechart if the ltaTraffic events don't have a Location?

sbnoobbb
Path Finder

I believed all my location that has accidents has changed to NULL. Including the 6 location I needed.

0 Karma

kailun92
Communicator

How can I correct it ? I only need the six location.

0 Karma

Ayn
Legend

This sounds dangerous - if ALL your Itatraffic events have the Location field, by doing "NOT Location=*" you are effectively removing all ItaTraffic events from your search altogether.

0 Karma

sbnoobbb
Path Finder

I had a null field for ltatraffic Location as all the other location is added into NULL, is there anyway to not show it ?

0 Karma

sbnoobbb
Path Finder

I needed only the 6 location from sourcetype="CurrentWeatherSGTraffic", which the 6 location is also in ltatraffic. Thanks !

0 Karma

sbnoobbb
Path Finder

My mistake, sourcetype="CurrentWeatherSGTraffic" contains only 6 Location while sourcetype="ltaTraffic" contains a lot.

0 Karma

Ayn
Legend

If both sourcetypes carry the same values for Location, I don't see what the problem is? Or for that matter how you want it to look instead?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...