Splunk Search

How to create an iterative search

timbCFCA
Path Finder

I'm trying to correlate my printer entries along the top printer / user combination line.
What I'm looking for in the way of output would be something like:

printer name 1 | user name 1 | user name 1 count | user name 2 | user name 2 count | ... etc. 
printer name 2 | user name 3 | user name 3 count | user name 2 | user name 2 count | ... etc.

I have a search prepared to locate the printer names in the first column:

evtid=10 host=print1* OR host=print2* NOT evtuser=*$ | table Printer_Name | dedup Printer_Name

I also have a search that provides the data I want for the remaining columns:

evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=PR-EAST | chart count by Printer_Name, evtuser

How do I glue these together to get the results I need? I'd rather not have to run hundreds of these queries by hand. I looked at subsearches and it doesn't look like that does quite what I need.

0 Karma
1 Solution

tfletcher_splun
Splunk Employee
Splunk Employee

Do it all in one search try:

evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=*| stats count by Printer_Name, evtuser | sort 0 Printer_Name, evtuser | stats list(evtuser) as users list(count) as counts by Printer_Name

This will give you each printer and then the users and counts in mv fileds. You can use further eval commands to pivot them into columns if you like. If you want one mv field just eval them together before final stats:

evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=*| stats count by Printer_Name, evtuser | sort 0 Printer_Name, evtuser | eval data=evtuser+":"+count | stats list(data) as data by Printer_Name

Hope that helps!

View solution in original post

tfletcher_splun
Splunk Employee
Splunk Employee

Do it all in one search try:

evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=*| stats count by Printer_Name, evtuser | sort 0 Printer_Name, evtuser | stats list(evtuser) as users list(count) as counts by Printer_Name

This will give you each printer and then the users and counts in mv fileds. You can use further eval commands to pivot them into columns if you like. If you want one mv field just eval them together before final stats:

evtid=10 host=print1* OR host=print2* NOT evtuser=*$ Printer_Name=*| stats count by Printer_Name, evtuser | sort 0 Printer_Name, evtuser | eval data=evtuser+":"+count | stats list(data) as data by Printer_Name

Hope that helps!

tfletcher_splun
Splunk Employee
Splunk Employee

change the order in the sort pipeline to include count. (I assume you still want it by printer)
... | sort 0 Printer_Name, count, evtuser | ...

0 Karma

timbCFCA
Path Finder

How do I sort the output of the stats by the count statement?

0 Karma

timbCFCA
Path Finder

Perfect. I just wasn't sure what the necessary syntax was.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...