Splunk Search

How to aggregate results based on a set of values

alejandrome
New Member

Hello all,

I have the following query:

index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | table _time, resultValue1, resultValue2, resultValue3 | sort _time

Quick explanation of the fields:

  1. attr1/2: these are some filters which have constants. Those are "irrelevant" to my problem right now.
  2. filterCriteria: The above query has one value as a filter, but I need to filter by two values. This means something like filterCriteria in("Criteria1", "Criteria2").

For achieving this, I tried to use join of two separate queries, based on the filterCriteria attribute, like this:

index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | join filterCriteria [search index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria2"] | table _time, resultValue1, resultValue2, resultValue3 | sort _time

But it seems that it's returning only the values of the last part of the join instead.

resultValue1/2/3 are fields with values shared by both queries, so they can be aggregated.

Is there a most efficient/another way to achieve this filtering by multivalued / in-like criteria?

Thanks in advance!

0 Karma

TISKAR
Builder

Hello,

Why you don't use the IN to filter request:

index=_internal name IN ("management","ingest")

in your case:

index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | table _time, resultValue1, resultValue2, resultValue3 | sort _time
0 Karma

to4kawa
Ultra Champion
(index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" ) OR (index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria2" ) 
| stats values(_time) as _time , values(resultValue1) as resultValues1, values(resultValue2) as resultValues2, values(resultValue3) as resultValues3 by filterCriteria 
| sort _time

try stats with by .

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...