Splunk Search

How to join or append searches in Splunk, with rest and subsearches?

Zarack
Engager

I tried to do it this way, but the results don't match.
How can i show the result of the first search and then the second one in columns of the correct order?


| rest /services/data/transforms/lookups
| table eai:acl.app eai:appName filename title fields_list updated id *
| where type="file"
| map maxsearches=1000 search="| inputlookup $filename$ | stats count | where count = 0 | eval lookup_vazia=$filename$"
|append
[ search index=_internal sourcetype=lookup_editor_rest_handler "Lookup edited successfully"
| stats count by _time user namespace lookup_file
| rename lookup_file as "lookup_editada"
]

Labels (3)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

To collapse those after the append, you just need to use 

| stats list(*) as * by common_field

but you need to have that common field. In your first search, the lookup is named lookup_vazia, but in the append it's lookup_editada.

If you make the field name the same in both cases and rename the first count to something else, so it will not conflict with the second count and do the stats above.

Note that list(*) will only produce 100 rows max per lookup - if you use values, it will sort each multi-value field, so the time, user and namespace fields will not correlate. If you need to handle that, I suggest you combine those 3 fields into a single field in the append and then user values(*) so you will get all values.

 

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...