Splunk Search

How to combine my three searches into one search?

manhuang
Explorer

Hi all,

I want to combine the three searches below into one to display all data in the result. However, it should not have poor performance and can be expanded in the future.

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40

index=application sourcetype=aEvent  splunk_server_group=ewea  host=*  level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8

Would you give some suggestions?

Tags (3)
0 Karma

somesoni2
Revered Legend

Try something like this. For any new set of eventName values, just add them to base search for filter and app in the case statement for filter based on count.

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error 
(eventName=A_ERROR OR eventName=B_EVENT) OR (eventName=C_EVENT OR eventName=D_EVENT) OR (eventName=E_EVENT OR eventName=F_EVENT) 
| stats count by eventName  
| eval ShouldInclude=case((eventName="A_ERROR" OR eventName="B_EVENT") AND count>40,"YES",(eventName="C_EVENT" OR eventName="D_EVENT") AND count>2,"YES",(eventName="E_EVENT" OR eventName="F_EVENT") AND count>8,"YES",1=1,"NO") 
| where ShouldInclude="YES" | fields - ShouldInclude
0 Karma

chimell
Motivator

hi
try this search code with set command

|set union [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40|fields eventName  count ][|set union [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2|fields eventName count][search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8|fields eventName count]]
0 Karma

ngatchasandra
Builder

Hi manhuang,

Try this

index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40
|appendcols [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2]
|appendcols [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8]
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try

index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error eventName=* 
|stats count(eval(eventName="A_ERROR" OR eventName="B_EVENT")) as AB_EVENT_COUNT,count(eval(eventName="C_EVENT" OR eventName="D_EVENT")) as CD_EVENT_COUNT,count(eval(eventName="E_EVENT" OR eventName="F_EVENT")) as ER_EVENT_COUNT
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...