How to combine my three searches into one search?

[manhuang]

Hi all,

I want to combine the three searches below into one to display all data in the result. However, it should not have poor performance and can be expanded in the future.

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40

index=application sourcetype=aEvent  splunk_server_group=ewea  host=*  level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8

Would you give some suggestions?

[somesoni2]

Try something like this. For any new set of eventName values, just add them to base search for filter and app in the case statement for filter based on count.

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error 
(eventName=A_ERROR OR eventName=B_EVENT) OR (eventName=C_EVENT OR eventName=D_EVENT) OR (eventName=E_EVENT OR eventName=F_EVENT) 
| stats count by eventName  
| eval ShouldInclude=case((eventName="A_ERROR" OR eventName="B_EVENT") AND count>40,"YES",(eventName="C_EVENT" OR eventName="D_EVENT") AND count>2,"YES",(eventName="E_EVENT" OR eventName="F_EVENT") AND count>8,"YES",1=1,"NO") 
| where ShouldInclude="YES" | fields - ShouldInclude

[chimell]

hi
try this search code with set command

|set union [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40|fields eventName  count ][|set union [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2|fields eventName count][search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8|fields eventName count]]

[ngatchasandra]

Hi manhuang,

Try this

index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40
|appendcols [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2]
|appendcols [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8]

[renjith_nair]

Try

index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error eventName=* 
|stats count(eval(eventName="A_ERROR" OR eventName="B_EVENT")) as AB_EVENT_COUNT,count(eval(eventName="C_EVENT" OR eventName="D_EVENT")) as CD_EVENT_COUNT,count(eval(eventName="E_EVENT" OR eventName="F_EVENT")) as ER_EVENT_COUNT