Splunk Search

Help creating a search that involves an IF statement and JOIN

tyhopping1
Engager

There are three different events. Each event has the same fields. The fields I am focusing are "NumberOfRecords" and "Message"

Event 1 - Message: "Promote" NumberOfRecords:*2
**Event 2
* - Message: "Evaluate" NumberOfRecords:*3
**Event 3
* - Message: "Retire" *NumberOfRecords:*1

I am in in need of an if statement (or any other method) that will combine these three events and returns all three counts with headings to designate which event it came from.

Example: if message = "Promote" then return 2 as the count for "Promote Count" and so on.
I am able to his is individual queries such as:

NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | search message="PROMOTE" 

However, I would like to do all three in one search. Any help is appreciated. Thank you

Tags (4)
0 Karma
1 Solution

adonio
Ultra Champion

what does this one gives you?

NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats sum(MunberOfRecords) by message

how about this one?
NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats values(MunberOfRecords) by message

View solution in original post

adonio
Ultra Champion

what does this one gives you?

NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats sum(MunberOfRecords) by message

how about this one?
NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats values(MunberOfRecords) by message

tyhopping1
Engager

Both queries provide exactly what I need. Thank you greatly for your help.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...