Splunk Search

How to combine two fields in a subsearch and return them together

ivykp
New Member

Hey guys,
I have the next query:

index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION
| eval x = [search index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION
| rename RESULTADO_VALIDACION.PROVISION_COMISION.RESULTADO as RESULTADO, RESULTADO_VALIDACION.PROVISION_COMISION.SUMA_GW as SUMA_GW
| dedup IDENTIFICADOR_ENTIDAD sortby +_time -FECHA_SAP
| eval SUMA_DELTA_OK=if((RESULTADO=="OK"), SUMA_GW, 0)
| eval SUMA_DELTA_ERROR=if((RESULTADO!="OK"), SUMA_GW, 0)
| stats count as DELTA_PROVISION sum(SUMA_DELTA_OK) as SUMA_DELTA_OK sum(SUMA_DELTA_ERROR) as SUMA_DELTA_ERROR
| eval result = ???
| return $result]
| table x

As you can see i have this two fields SUMA_DELTA_OK and SUMA_DELTA_ERROR, i need to return both of them as result of the subsearch so i avoid to make a subsearch for OK and ERROR.

Any idea how to do this? returning a tuple, and array or something? Also how do i extract them after that.

Thanks!

Tags (1)
0 Karma

somesoni2
Revered Legend

In your main search, only thing you're doing is displaying result of subsearch in each row. Do you really want to do that or it's just half search you wrote to post question here? If you really want to do that, just run the subsearch as main search.

index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION
 | rename RESULTADO_VALIDACION.PROVISION_COMISION.RESULTADO as RESULTADO, RESULTADO_VALIDACION.PROVISION_COMISION.SUMA_GW as SUMA_GW
 | dedup IDENTIFICADOR_ENTIDAD sortby +_time -FECHA_SAP
 | eval SUMA_DELTA_OK=if((RESULTADO=="OK"), SUMA_GW, 0)
 | eval SUMA_DELTA_ERROR=if((RESULTADO!="OK"), SUMA_GW, 0)
 | stats count as DELTA_PROVISION sum(SUMA_DELTA_OK) as SUMA_DELTA_OK sum(SUMA_DELTA_ERROR) as SUMA_DELTA_ERROR

If you really have some further calculations to be done based on two fields you want to return, you can return a concatenated field and split it later.

index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION
 | eval x = [search index=idx_rtd_prc sourcetype=rbt_rtd_src_type TIPO_ENTIDAD=PROVISION_COMISION MONEDA=COP TIPO_MENSAJE=VALIDACION
 | rename RESULTADO_VALIDACION.PROVISION_COMISION.RESULTADO as RESULTADO, RESULTADO_VALIDACION.PROVISION_COMISION.SUMA_GW as SUMA_GW
 | dedup IDENTIFICADOR_ENTIDAD sortby +_time -FECHA_SAP
 | eval SUMA_DELTA_OK=if((RESULTADO=="OK"), SUMA_GW, 0)
 | eval SUMA_DELTA_ERROR=if((RESULTADO!="OK"), SUMA_GW, 0)
 | stats count as DELTA_PROVISION sum(SUMA_DELTA_OK) as SUMA_DELTA_OK sum(SUMA_DELTA_ERROR) as SUMA_DELTA_ERROR
 | eval result = "DELTA_PROVISION=".DELTA_PROVISION." SUMA_DELTA_OK=".SUMA_DELTA_OK." SUMA_DELTA_ERROR=".SUMA_DELTA_ERROR
 | return $result] 
 | table x
 | rex field=x "DELTA_PROVISION=(?<DELTA_PROVISION>\S+) SUMA_DELTA_OK=(?<SUMA_DELTA_OK>\S+) SUMA_DELTA_ERROR=(?<SUMA_DELTA_ERROR>\S+)"
0 Karma
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...