Hi Splunkers,
This is my first post as I am new to using splunk, but my issue arising when I am trying to pull specific values from a time range within one search. To do this I am using appendcols to add another search, and designate a new value for earliest and latest, then use the "stats latest (field) as 'name' by field, field" command to pull these values out. Here is an example query:
index="index" <search> earliest=-4h@h latest=@h
|stats latest(FieldA) as DataNew earliest(FieldA) as DataOld by Field1, Field2, Field 3
|appendcols
[search index="index" <search> earliest=-3h@h latest=-1@h
|stats latest(FieldA) as DataMidOld earliest(FieldA) as DataMidNew by Field1, Field2, Field3]
|table DataNew,DataMidNew, DataMidOld, DataOld, Field1, Field2, Field3
In my mind, I see no error with this search, but the values for DataMidOld and DataMidNew do not align with the actual data, and are seemingly random. Any help is appreciated!
The appendcols command rarely is the right answer to an SPL problem. You probably want append.
index="index" <search> earliest=-4h@h latest=@h
|stats latest(FieldA) as DataNew earliest(FieldA) as DataOld by Field1, Field2, Field 3
|append
[search index="index" <search> earliest=-3h@h latest=-1@h
|stats latest(FieldA) as DataMidOld earliest(FieldA) as DataMidNew by Field1, Field2, Field3]
``` Re-group the results ```
| stats values(*) as * by Field1, Field2, Field3
|table DataNew,DataMidNew, DataMidOld, DataOld, Field1, Field2, Field3
The biggest problem with appendcols is that it requires the results be in the exact same sequence as those from the main search - otherwise, gibberish can result.
I think this fixed my issue! thanks! just out of curiosity, what does adding the values(*) do, not sure I have seen that before
The appendcols command rarely is the right answer to an SPL problem. You probably want append.
index="index" <search> earliest=-4h@h latest=@h
|stats latest(FieldA) as DataNew earliest(FieldA) as DataOld by Field1, Field2, Field 3
|append
[search index="index" <search> earliest=-3h@h latest=-1@h
|stats latest(FieldA) as DataMidOld earliest(FieldA) as DataMidNew by Field1, Field2, Field3]
``` Re-group the results ```
| stats values(*) as * by Field1, Field2, Field3
|table DataNew,DataMidNew, DataMidOld, DataOld, Field1, Field2, Field3
The biggest problem with appendcols is that it requires the results be in the exact same sequence as those from the main search - otherwise, gibberish can result.