Splunk Search

How do I display and email search results from two different result sets?

srungta
New Member

How do I edit my current search?

index=myindex sourcetype=A OR sourcetype=B earliest=-72h ERROR_CODE=5014 AND TXN_DESC=W* |fields TXN_DESC |eval weborder=substr(TXN_DESC,1,10)| stats values(weborder) as weborder|join type=outer [ search index=myindex sourcetype=A OR sourcetype=B earliest=-72h ERROR_CODE=5014 AND TXN_DESC=W* |stats count as totalevent|fields weborder,totalevent| search totalevent>10|sendemail from =user123@company.com to=mygroup@group.company.com server=mail.company.com use_ssl=true username="user123" user="user123" password="****" content_type=html subject="Partner API Resurrect Failure" message=weborder format=table,csv sendresults=true]
0 Karma

sundareshr
Legend

There are a couple of question I have with your current search..

1) Why do you need a join? Is it because you want to include totalcount and values(weborder)? Your base search is identical for both.

2) The reason you're probably not getting the expected results is, in your subsearch you have a stats that only returns the totalevent column and not the weborder column. To fix this, I would suggest you try the following, although without knowing your requirement, I am not sure this is will meet your need.

index=myindex sourcetype=A OR sourcetype=B earliest=-72h ERROR_CODE=5014 AND TXN_DESC=W* 
| eval weborder=substr(TXN_DESC,1,10)
| stats values(weborder) as weborder count as totalevent
| search totalevent>10
| sendemail from =user123@company.com to=mygroup@group.company.com server=mail.company.com use_ssl=true username="user123" user="user123" password="****" content_type=html subject="Partner API Resurrect Failure" message=weborder format=table,csv sendresults=true
0 Karma

rafamss
Contributor

Hi srungta,

I would try to do this way:

(index=myindex OR index=myindex1) AND (sourcetype=A OR sourcetype=B) 
earliest=-72h ERROR_CODE=5014 AND TXN_DESC=W* 
| stats count as totalevent
| eval weborder=substr(TXN_DESC,1,10) 
| stats values(weborder) as weborder
| fields weborder,totalevent 
| search totalevent>10 
| sendemail from=user123@company.com to=mygroup@group.company.com server=mail.company.com use_ssl=true username="user123" user="user123" password="****" content_type=html subject="Partner API Resurrect Failure" message=weborder format=table,csv sendresults=true 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...