I have two Searches and following are its result individually -
index="myindex" <my search 1> | table App Size Count
App Size Count
App1 5GB 100
App2 100GB 10000
index=myindex" <my search 2> | table App Size Count
App Size Count
App3 15GB 1500
Now I want to run a report that shows result of all Apps (1 to 3) together. So, I used append.
index="myindex" <my search 1> | table App Size Count
| append
[search index=myindex" <my search 2> | table App Size Count]
| addcoltotals
But when I used it, I didn't get the complete result. "Size" column is showing different value. Something like this -
App Size Count
App1 5GB 100
App2 100GB 10000
App3 7GB 720
What should be used to get the complete resultset as we got for each search. Best way to merge two query resultsets.
Thanks!
must be missing our something in the syntax but if I just use the OR between two searches like below I am getting Error in 'search' command: Unable to parse the search: unbalanced parentheses.
(<my search 1> OR <my search 2>)
I have provided the complete search command above in reply to Renjith.
You may try
index=myindex (search1 terms OR search2 terms) |table App,Size,Count|addcoltotals
Here is the updated Query which actual use of REX/EVAL/CASE/STATS in it:
(index="myindex" "*upload succeeded" OR "*streaming succeeded" NOT "source"
| rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size count | eval App="Upload-Manual")
OR
(index="myindex" "*upload succeeded" OR "*streaming succeeded"
| rex "source=(?<App>[^,]+)."
| rex "system=(?<App>[^,]+)." | eval App = case(App="FB","App1",App="TWTR","App2",App="Salesforce","App3",App="SAP","App3",App="Oracle","App3")
| rex ".*SIZE=(?<sizeKB>\d+\.\d+)" | stats sum(eval(sizeKB/1024/1024)) AS Size Count by App)
| table App Size Count
| addcoltotals
I am getting following error -
Error in 'search' command: Unable to parse the search: unbalanced parentheses.
Thanks!
Hi @runiyal,
did you tried to put all the conditions in the main search?
something like this:
index="myindex" (<my search 1> OR <my search 2>)
| table App Size Count
| addcoltotals
Splunk isn't a DB!
Ciao.
Giuseppe