Splunk Search

How to combine my three searches into one search?

manhuang
Explorer

Hi all,

I want to combine the three searches below into one to display all data in the result. However, it should not have poor performance and can be expanded in the future.

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40

index=application sourcetype=aEvent  splunk_server_group=ewea  host=*  level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8

Would you give some suggestions?

Tags (3)
0 Karma

somesoni2
Revered Legend

Try something like this. For any new set of eventName values, just add them to base search for filter and app in the case statement for filter based on count.

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error 
(eventName=A_ERROR OR eventName=B_EVENT) OR (eventName=C_EVENT OR eventName=D_EVENT) OR (eventName=E_EVENT OR eventName=F_EVENT) 
| stats count by eventName  
| eval ShouldInclude=case((eventName="A_ERROR" OR eventName="B_EVENT") AND count>40,"YES",(eventName="C_EVENT" OR eventName="D_EVENT") AND count>2,"YES",(eventName="E_EVENT" OR eventName="F_EVENT") AND count>8,"YES",1=1,"NO") 
| where ShouldInclude="YES" | fields - ShouldInclude
0 Karma

chimell
Motivator

hi
try this search code with set command

|set union [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40|fields eventName  count ][|set union [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2|fields eventName count][search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8|fields eventName count]]
0 Karma

ngatchasandra
Builder

Hi manhuang,

Try this

index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40
|appendcols [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2]
|appendcols [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8]
0 Karma

renjith_nair
Legend

Try

index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error eventName=* 
|stats count(eval(eventName="A_ERROR" OR eventName="B_EVENT")) as AB_EVENT_COUNT,count(eval(eventName="C_EVENT" OR eventName="D_EVENT")) as CD_EVENT_COUNT,count(eval(eventName="E_EVENT" OR eventName="F_EVENT")) as ER_EVENT_COUNT
---
What goes around comes around. If it helps, hit it with Karma :slightly_smiling_face:
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...