Splunk Search

How to aggregate results based on a set of values

alejandrome
New Member

Hello all,

I have the following query:

index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | table _time, resultValue1, resultValue2, resultValue3 | sort _time

Quick explanation of the fields:

  1. attr1/2: these are some filters which have constants. Those are "irrelevant" to my problem right now.
  2. filterCriteria: The above query has one value as a filter, but I need to filter by two values. This means something like filterCriteria in("Criteria1", "Criteria2").

For achieving this, I tried to use join of two separate queries, based on the filterCriteria attribute, like this:

index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | join filterCriteria [search index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria2"] | table _time, resultValue1, resultValue2, resultValue3 | sort _time

But it seems that it's returning only the values of the last part of the join instead.

resultValue1/2/3 are fields with values shared by both queries, so they can be aggregated.

Is there a most efficient/another way to achieve this filtering by multivalued / in-like criteria?

Thanks in advance!

0 Karma

TISKAR
Builder

Hello,

Why you don't use the IN to filter request:

index=_internal name IN ("management","ingest")

in your case:

index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | table _time, resultValue1, resultValue2, resultValue3 | sort _time
0 Karma

to4kawa
Ultra Champion
(index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" ) OR (index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria2" ) 
| stats values(_time) as _time , values(resultValue1) as resultValues1, values(resultValue2) as resultValues2, values(resultValue3) as resultValues3 by filterCriteria 
| sort _time

try stats with by .

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...