Splunk Search

How to combine two search results in a better way

dibyaranjan3177
New Member

Hello,

I am trying to create a query which will help me combine results from two search results by doing this:

 index=some_index source="log_source" AND "Not Updated - sourceId" 
 | stats count as RejectedEvents 
 | appendcols [
     search index=some_index source="log_source" 
     | rex ".*Batch info: completed, processed entities: (?<numberOfMessage>.*)"
     | stats sum(numberOfMessage) as ProcessedEvents
   ] 
 | eval total = ProcessedEvents + RejectedEvents
 | fields total

This query works fine, but is insanely slow. Any help on making this better?

0 Karma

woodcock
Esteemed Legend

Try this:

index="some_index" AND source="log_source"
| rex ".*Batch info: completed, processed entities: (?<numberOfMessage>.*)"
| stats sum(numberOfMessage) AS ProcessedEvents count AS total_raw count(eval(searchmatch("Not Updated - sourceId"))) AS RejectedEvents
| eval total_true = ProcessedEvents + RejectedEvents
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This may be a little better.

(index=some_index source="log_source") OR (index=some_index source="log_source" "Not Updated - sourceId" )
| eval Rejected = if (match(_raw, "Not Updated - sourceId"), 1, 0)
| rex ".*Batch info: completed, processed entities: (?<numberOfMessage>.*)"
| stats sum(Rejected) as RejectedEvents, sum(numberOfMessage) as ProcessedEvents
| eval total = ProcessedEvents + RejectedEvents
| fields total
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...