Splunk Search

How to extract data

1014502
New Member

I want to know how to take data from multiple data sources by ID.
The following is an example of a data source.
A Datasource(A-id,B-id or C-id,B-Manhour or C-Manhour)
B Datasource(B-id,B-subject)
C Datasource(C-id,B-id,C-subject)
※A datasource is Man-hour information、B Datasource is Parent ticket information、C-datasource is Child ticket information

I want the output below.
id subject man-hour
B-id B-subject Total value of B-Manhour
B-id B-subject Total value of B-Manhour+Total value of C-Manhour
B-id B-subject Total value of C-Manhour

Please tell me how to do it.

0 Karma
1 Solution

to4kawa
Ultra Champion
index=your_index source=A OR source=B OR souce=C
| stats sum(Manhour) as Monhour values(subject) as subject by B-id , C-id

There is no sample, maybe not works.
That's life.

View solution in original post

0 Karma

to4kawa
Ultra Champion
index=your_index source=A OR source=B OR souce=C
| stats sum(Manhour) as Monhour values(subject) as subject by B-id , C-id

There is no sample, maybe not works.
That's life.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @1014502,
your requisites aren't so clear, correct me if I'm wrong:

  • in A Datasource all the fields are in different columns (A-id,B-id or C-id,B-Manhour or C-Manhour);
  • you want different calculations for each row (in row1 B-Manhour, in row2 B-Manhour+Total value of C-Manhour and in row3 C-Manhour)
  • you want three rows for each B-id,
  • relation between B-id and C-id is in C Datasource.

Is it correct?

Ciao.
Giuseppe

0 Karma

1014502
New Member

Hi@gcusello
.in A Datasource all the fields are in different columns (A-id,B-id or C-id,B-Manhour or C-Manhour);

Example for A Datasource bellow.
( A-id,B-id,B-Manhour
A-id,C-id,C-Manhour )
A Datasource is the man-hour information of B ticket or C ticket.
・you want different calculations for each row (in row1 B-Manhour, in row2 B-Manhour+Total value of C-Manhour and in row3 C-Manhour)
Yes.
・you want three rows for each B-id,
Yes.
relation between B-id and C-id is in C Datasource.
Yes.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @1014502,
if it's acceptable for you to have results in three columns, you could run something like this:

index=A Or index=B OR index=C
| stats sum(B-Manhour) AS B-Manhour sum(C-Manhour) AS C-Manhour BY B-id
| eval BC=B-Manhour+C-Manhour

I cannot test it, check in this way or adding C-id in BY clause of the stats command:

index=A Or index=B OR index=C
| stats sum(B-Manhour) AS B-Manhour sum(C-Manhour) AS C-Manhour BY B-id C-id
| eval BC=B-Manhour+C-Manhour

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...