Splunk Search

How to edit my search to combine 4 columns into one total column?

JoshuaJohn
Contributor

Hi

I'm new to the community and to Splunk. I am trying to combine the 4 columns my search creates into one total column or one column that is separated by the 4 search terms (it's one column with different colors for the different search terms) . This is my search term below: (This creates 4 columns: CREATED, LINKED, Session_Cancelled, and Session_Failed)

index=company_myapp REQUEST_URL:*payment/myapp* AND (REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND (CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  | rex "CURRENT_STATUS:(?.*)" |stats count by status_name

I tried this, but Splunk said index is not a search term.

index=company_myapp REQUEST_URL:*payment/myapp* AND (REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND (CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  | rex "CURRENT_STATUS:(?.*)" |stats count by status_name | append [index=company_myapp REQUEST_URL:*payment/myapp* | stats count by URL]

Any suggestions, ideas?

0 Karma

sundareshr
Legend

See if this gives you what you are looking for

index=company_myapp REQUEST_URL:*payment/myapp* AND (REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND (CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  | rex "CURRENT_STATUS:(?.*)" | stats latest(status_name) as status by url
0 Karma

JoshuaJohn
Contributor

This returned "no data"

0 Karma

sundareshr
Legend

Does your data have status_name and url fields extracted? If no, those need to be extracted using rex or some other method.

0 Karma

Raschko
Communicator

Subsearches have to start with the command search. So this should work:

     index=company_myapp REQUEST_URL:*payment/myapp* AND 
(REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND 
(CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  
    | rex "CURRENT_STATUS:(?<status_name>.*)" 
    | stats count by status_name 
    | append [search index=company_myapp REQUEST_URL:*payment/myapp* | stats count by URL]

Edit:
Your rex command is wrong in this. Sorry no testing ground at the moment.
Not sure about the field name status_name.

If all fails, do you have some example events (sanitized) to show?

0 Karma

JoshuaJohn
Contributor

This returned the original graph to me

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...