Splunk Search

How to Merge two query resultsets?

runiyal
Path Finder

I have two Searches and following are its result individually -

index="myindex" <my search 1> | table App Size Count

App  Size  Count
App1 5GB   100
App2 100GB 10000

index=myindex" <my search 2> | table App Size Count

App  Size Count
App3 15GB 1500

Now I want to run a report that shows result of all Apps (1 to 3) together. So, I used append.

index="myindex" <my search 1> | table App Size Count
| append
[search index=myindex" <my search 2> | table App Size Count]
| addcoltotals

But when I used it, I didn't get the complete result. "Size" column is showing different value. Something like this -

App  Size  Count
App1 5GB   100
App2 100GB 10000
App3 7GB   720

What should be used to get the complete resultset as we got for each search. Best way to merge two query resultsets.

 

Thanks!

Labels (2)
Tags (1)
0 Karma

runiyal
Path Finder

must be missing our something in the syntax but if I just use the OR between two searches like below I am getting Error in 'search' command: Unable to parse the search: unbalanced parentheses.

(<my search 1> OR <my search 2>)

 I have provided the complete search command above in reply to Renjith.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

You may try

index=myindex (search1 terms OR search2 terms) |table App,Size,Count|addcoltotals

splunk_search.jpg

Happy Splunking!
0 Karma

runiyal
Path Finder

Here is the updated Query which actual use of REX/EVAL/CASE/STATS in it:

(index="myindex" "*upload succeeded" OR "*streaming succeeded" NOT "source"
| rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size count | eval App="Upload-Manual")
OR
(index="myindex" "*upload succeeded" OR "*streaming succeeded"
| rex "source=(?<App>[^,]+)."
| rex "system=(?<App>[^,]+)." | eval App = case(App="FB","App1",App="TWTR","App2",App="Salesforce","App3",App="SAP","App3",App="Oracle","App3")
| rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size Count by App)
| table App Size Count
| addcoltotals

 

I am getting following error - 

Error in 'search' command: Unable to parse the search: unbalanced parentheses.

 

Thanks!

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @runiyal,

did you tried to put all the conditions in the main search?

something like this:

index="myindex" (<my search 1> OR <my search 2>)
| table App Size Count
| addcoltotals

Splunk isn't a DB!

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...