Splunk Search

How to combine two splunk searches based on a common field and display as single chart or table?

vdalvi
Explorer

HI,

I have two searches per below

index=* host=* source=*
| eval TopicName=split(topicName,".")
| chart sum(size) as Todays_Count over TopicName | sort Todays_Count
| append
[
index=* host=* source=*
| stats count by propertiesTopicName, expectedCount | table propertiesTopicName expectedCount | sort expectedCount
]

Here I am using append which basically appends the result of 2nd search below the first search. I am looking to have it displayed besides one another based on the common field values of "TopicName" and "propertiesTopicName"

Basically end result I want is 3 columns being

propertiesTopicName | Todays_Count | expectedCount

How can I achieve this ? Please help 🙂

Labels (4)
1 Solution

bowesmana
SplunkTrust
SplunkTrust

It's unclear to me if propertiesTopicName and the multi valued split results from topicName are the same. If so, then why are you not using propertiesTopicName in the first search?

Anyway, the simple answer to what you look like you're trying to do is

index=* host=* source=*
| eval TopicName=split(topicName,".")
| chart sum(size) as Todays_Count over TopicName 
| rename TopicName as propertiesTopicName
| append
[
  index=* host=* source=*
  | stats count by propertiesTopicName, expectedCount 
  | table propertiesTopicName expectedCount 
]
| stats values(*) as * by propertiesTopicName
| sort Todays_Count expectedCount

You will need to resolve how you want the results to be sorted at the end.

But I suspect there is a simpler solution, but would need to understand what your data looks like.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

It's unclear to me if propertiesTopicName and the multi valued split results from topicName are the same. If so, then why are you not using propertiesTopicName in the first search?

Anyway, the simple answer to what you look like you're trying to do is

index=* host=* source=*
| eval TopicName=split(topicName,".")
| chart sum(size) as Todays_Count over TopicName 
| rename TopicName as propertiesTopicName
| append
[
  index=* host=* source=*
  | stats count by propertiesTopicName, expectedCount 
  | table propertiesTopicName expectedCount 
]
| stats values(*) as * by propertiesTopicName
| sort Todays_Count expectedCount

You will need to resolve how you want the results to be sorted at the end.

But I suspect there is a simpler solution, but would need to understand what your data looks like.

 

vdalvi
Explorer

Thank you! this is exactly what I was looking for 🙂

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...