Splunk Search

How to Merge two query resultsets?

runiyal
Path Finder

I have two Searches and following are its result individually -

index="myindex" <my search 1> | table App Size Count

App  Size  Count
App1 5GB   100
App2 100GB 10000

index=myindex" <my search 2> | table App Size Count

App  Size Count
App3 15GB 1500

Now I want to run a report that shows result of all Apps (1 to 3) together. So, I used append.

index="myindex" <my search 1> | table App Size Count
| append
[search index=myindex" <my search 2> | table App Size Count]
| addcoltotals

But when I used it, I didn't get the complete result. "Size" column is showing different value. Something like this -

App  Size  Count
App1 5GB   100
App2 100GB 10000
App3 7GB   720

What should be used to get the complete resultset as we got for each search. Best way to merge two query resultsets.

 

Thanks!

Labels (2)
Tags (1)
0 Karma

runiyal
Path Finder

must be missing our something in the syntax but if I just use the OR between two searches like below I am getting Error in 'search' command: Unable to parse the search: unbalanced parentheses.

(<my search 1> OR <my search 2>)

 I have provided the complete search command above in reply to Renjith.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You may try

index=myindex (search1 terms OR search2 terms) |table App,Size,Count|addcoltotals

splunk_search.jpg

Happy Splunking!
0 Karma

runiyal
Path Finder

Here is the updated Query which actual use of REX/EVAL/CASE/STATS in it:

(index="myindex" "*upload succeeded" OR "*streaming succeeded" NOT "source"
| rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size count | eval App="Upload-Manual")
OR
(index="myindex" "*upload succeeded" OR "*streaming succeeded"
| rex "source=(?<App>[^,]+)."
| rex "system=(?<App>[^,]+)." | eval App = case(App="FB","App1",App="TWTR","App2",App="Salesforce","App3",App="SAP","App3",App="Oracle","App3")
| rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size Count by App)
| table App Size Count
| addcoltotals

 

I am getting following error - 

Error in 'search' command: Unable to parse the search: unbalanced parentheses.

 

Thanks!

Tags (1)
0 Karma

gcusello
Esteemed Legend

Hi @runiyal,

did you tried to put all the conditions in the main search?

something like this:

index="myindex" (<my search 1> OR <my search 2>)
| table App Size Count
| addcoltotals

Splunk isn't a DB!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...