Splunk Search

How to join or append searches in Splunk, with rest and subsearches?

Zarack
Engager

I tried to do it this way, but the results don't match.
How can i show the result of the first search and then the second one in columns of the correct order?


| rest /services/data/transforms/lookups
| table eai:acl.app eai:appName filename title fields_list updated id *
| where type="file"
| map maxsearches=1000 search="| inputlookup $filename$ | stats count | where count = 0 | eval lookup_vazia=$filename$"
|append
[ search index=_internal sourcetype=lookup_editor_rest_handler "Lookup edited successfully"
| stats count by _time user namespace lookup_file
| rename lookup_file as "lookup_editada"
]

Labels (3)
Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

To collapse those after the append, you just need to use 

| stats list(*) as * by common_field

but you need to have that common field. In your first search, the lookup is named lookup_vazia, but in the append it's lookup_editada.

If you make the field name the same in both cases and rename the first count to something else, so it will not conflict with the second count and do the stats above.

Note that list(*) will only produce 100 rows max per lookup - if you use values, it will sort each multi-value field, so the time, user and namespace fields will not correlate. If you need to handle that, I suggest you combine those 3 fields into a single field in the append and then user values(*) so you will get all values.

 

0 Karma
Get Updates on the Splunk Community!

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...