Splunk Search

Help creating a search that involves an IF statement and JOIN

tyhopping1
Engager

There are three different events. Each event has the same fields. The fields I am focusing are "NumberOfRecords" and "Message"

Event 1 - Message: "Promote" NumberOfRecords:*2
**Event 2
* - Message: "Evaluate" NumberOfRecords:*3
**Event 3
* - Message: "Retire" *NumberOfRecords:*1

I am in in need of an if statement (or any other method) that will combine these three events and returns all three counts with headings to designate which event it came from.

Example: if message = "Promote" then return 2 as the count for "Promote Count" and so on.
I am able to his is individual queries such as:

NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | search message="PROMOTE" 

However, I would like to do all three in one search. Any help is appreciated. Thank you

Tags (4)
0 Karma
1 Solution

adonio
Ultra Champion

what does this one gives you?

NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats sum(MunberOfRecords) by message

how about this one?
NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats values(MunberOfRecords) by message

View solution in original post

adonio
Ultra Champion

what does this one gives you?

NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats sum(MunberOfRecords) by message

how about this one?
NameOfJob= GH0A | spath NumberOfRecords | search NumberOfRecords=*| spath message | stats values(MunberOfRecords) by message

tyhopping1
Engager

Both queries provide exactly what I need. Thank you greatly for your help.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...