Splunk Search

How can I get the results of merging?

Explorer

There are two result sets , How can I get the results of merging? and how does command (join) use?
alt text

1 Solution

SplunkTrust
SplunkTrust

hello there,

assuming the field names for "project" and "yyyymm" are the same in both data sets, you can use stats instead of join
in your case, try this:

 .... your search ... "find results set 1" OR "find results set 2" ...
| stats values(fee) as fee values(vm_count) as vm_vount by project yyyymm

here is an example search to run anywhere:

| makeresults count=1 
| eval result_set_1 = "201808,cas,100;201808,at,120;201808,srm,2019"
| makemv delim=";" result_set_1
| mvexpand result_set_1
| rex field=result_set_1 "(?<yyyymm>\d{6})\,(?<project>[^,]+)\,(?<fee>\d+)"
| append
[ | makeresults count=1 
  | eval result_set_2 = "201808,cas,1;201808,at,2;201808,srm,10;201808,commonservice,1000"
  | makemv delim=";" result_set_2
  | mvexpand result_set_2 
  | rex field=result_set_2 "(?<yyyymm>\d{6})\,(?<project>[^,]+)\,(?<vm_count>\d+)" ]
| rename COMMENT as "the above generates data, below is your solution"
| stats values(fee) as fee values(vm_count) as vm_vount by project yyyymm

screenshot:
alt text

hope it helps

View solution in original post

SplunkTrust
SplunkTrust

hello there,

assuming the field names for "project" and "yyyymm" are the same in both data sets, you can use stats instead of join
in your case, try this:

 .... your search ... "find results set 1" OR "find results set 2" ...
| stats values(fee) as fee values(vm_count) as vm_vount by project yyyymm

here is an example search to run anywhere:

| makeresults count=1 
| eval result_set_1 = "201808,cas,100;201808,at,120;201808,srm,2019"
| makemv delim=";" result_set_1
| mvexpand result_set_1
| rex field=result_set_1 "(?<yyyymm>\d{6})\,(?<project>[^,]+)\,(?<fee>\d+)"
| append
[ | makeresults count=1 
  | eval result_set_2 = "201808,cas,1;201808,at,2;201808,srm,10;201808,commonservice,1000"
  | makemv delim=";" result_set_2
  | mvexpand result_set_2 
  | rex field=result_set_2 "(?<yyyymm>\d{6})\,(?<project>[^,]+)\,(?<vm_count>\d+)" ]
| rename COMMENT as "the above generates data, below is your solution"
| stats values(fee) as fee values(vm_count) as vm_vount by project yyyymm

screenshot:
alt text

hope it helps

View solution in original post