Splunk Search

How to extract data

1014502
New Member

I want to know how to take data from multiple data sources by ID.
The following is an example of a data source.
A Datasource(A-id,B-id or C-id,B-Manhour or C-Manhour)
B Datasource(B-id,B-subject)
C Datasource(C-id,B-id,C-subject)
※A datasource is Man-hour information、B Datasource is Parent ticket information、C-datasource is Child ticket information

I want the output below.
id subject man-hour
B-id B-subject Total value of B-Manhour
B-id B-subject Total value of B-Manhour+Total value of C-Manhour
B-id B-subject Total value of C-Manhour

Please tell me how to do it.

0 Karma
1 Solution

to4kawa
Ultra Champion
index=your_index source=A OR source=B OR souce=C
| stats sum(Manhour) as Monhour values(subject) as subject by B-id , C-id

There is no sample, maybe not works.
That's life.

View solution in original post

0 Karma

to4kawa
Ultra Champion
index=your_index source=A OR source=B OR souce=C
| stats sum(Manhour) as Monhour values(subject) as subject by B-id , C-id

There is no sample, maybe not works.
That's life.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @1014502,
your requisites aren't so clear, correct me if I'm wrong:

  • in A Datasource all the fields are in different columns (A-id,B-id or C-id,B-Manhour or C-Manhour);
  • you want different calculations for each row (in row1 B-Manhour, in row2 B-Manhour+Total value of C-Manhour and in row3 C-Manhour)
  • you want three rows for each B-id,
  • relation between B-id and C-id is in C Datasource.

Is it correct?

Ciao.
Giuseppe

0 Karma

1014502
New Member

Hi@gcusello
.in A Datasource all the fields are in different columns (A-id,B-id or C-id,B-Manhour or C-Manhour);

Example for A Datasource bellow.
( A-id,B-id,B-Manhour
A-id,C-id,C-Manhour )
A Datasource is the man-hour information of B ticket or C ticket.
・you want different calculations for each row (in row1 B-Manhour, in row2 B-Manhour+Total value of C-Manhour and in row3 C-Manhour)
Yes.
・you want three rows for each B-id,
Yes.
relation between B-id and C-id is in C Datasource.
Yes.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @1014502,
if it's acceptable for you to have results in three columns, you could run something like this:

index=A Or index=B OR index=C
| stats sum(B-Manhour) AS B-Manhour sum(C-Manhour) AS C-Manhour BY B-id
| eval BC=B-Manhour+C-Manhour

I cannot test it, check in this way or adding C-id in BY clause of the stats command:

index=A Or index=B OR index=C
| stats sum(B-Manhour) AS B-Manhour sum(C-Manhour) AS C-Manhour BY B-id C-id
| eval BC=B-Manhour+C-Manhour

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...