Splunk Search

Help creating a search that involves an IF statement and JOIN

tyhopping1
Engager

There are three different events. Each event has the same fields. The fields I am focusing are "NumberOfRecords" and "Message"

Event 1 - Message: "Promote" NumberOfRecords:*2
**Event 2
* - Message: "Evaluate" NumberOfRecords:*3
**Event 3
* - Message: "Retire" *NumberOfRecords:*1

I am in in need of an if statement (or any other method) that will combine these three events and returns all three counts with headings to designate which event it came from.

Example: if message = "Promote" then return 2 as the count for "Promote Count" and so on.
I am able to his is individual queries such as:

NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | search message="PROMOTE" 

However, I would like to do all three in one search. Any help is appreciated. Thank you

Tags (4)
0 Karma
1 Solution

adonio
Ultra Champion

what does this one gives you?

NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats sum(MunberOfRecords) by message

how about this one?
NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats values(MunberOfRecords) by message

View solution in original post

adonio
Ultra Champion

what does this one gives you?

NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats sum(MunberOfRecords) by message

how about this one?
NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats values(MunberOfRecords) by message

tyhopping1
Engager

Both queries provide exactly what I need. Thank you greatly for your help.

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...