Splunk Search

How to join two fields?

venkatesh296
Explorer

Hi All,
After doing some search, I got output as

x                                                                avg                 median
2017-01-11 12:16:00,[Process],D:\Program Files\local.Log         3                   5

The output I need should be like

 x                                                               avg                 median
2017-01-11 12:16:00,
[Process],
D:\Program Files\local.Log                                       3                   5

Thanks.

Here is the search:

index=abs (source=*log*)
| rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\" 
|eval seconds=(seconds/1000)
|eval seconds=coalesce(seconds,us)
| eval source=replace(source,"\d+\.log$",".log")
| table  _time sourceMETHOD seconds  
| bin  _time span=1m 
|eval _time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|eval x=_time.",".METHOD.",".source
| stats  median(seconds) as median by x source METHOD 
| search METHOD="[Process]"
|eventstats  count as Linecount sum(median) as Total
|eval average=Total/Linecount
|fields x average median
Tags (2)
0 Karma

lguinn2
Legend

When you pasted your search into the comment, it lost some information. The rex commands don't make any sense now - but I have copied them here. This should work

 index=abs source=*log*
 | rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\"
 | search METHOD="[Process]"
 | eval seconds=(seconds/1000)
 | eval seconds=coalesce(seconds,us)
 | eval source=replace(source,"\d+\.log$",".log")
 | bin span=1m _time
 | eval x = strftime(_time,"%x %X") . "\n" . METHOD . "\n" . source
 | stats median(seconds) as median by x 
 | eventstats count as Linecount sum(median) as Total
 | eval average=Total/Linecount
 | fields x average median

Although it seems to me that METHOD is not really needed at all, since you have filtered to show only the Process method. And I am a bit uncomfortable with the calculation of average: in the eventstats command, as count will be only a count of the number of stats results, not the count of events returned by the search. I did a couple of things to make the search more efficient.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What is the difference in these two outputs? single line vs multiline?? If that is the case, try this

your current search giving fields x, average, median | makemv x delim=","
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@venkatesh296 - Can you provide the search that you used? That would be helpful for users attempting to assist you in how you got your initial output and how you want your output to look like.

In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible. Thanks.

0 Karma

venkatesh296
Explorer
index=abs (source=*log*)   | rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\" |eval seconds=(seconds/1000)|eval seconds=coalesce(seconds,us)| eval source=replace(source,"\d+\.log$",".log")| table  _time sourceMETHOD seconds  | bin  _time span=1m |eval _time=strftime(_time,"%Y-%m-%d %H:%M:%S")|eval x=_time.",".METHOD.",".source| stats  median(seconds) as median by x source METHOD | search METHOD="[Process]"|eventstats  count as Linecount sum(median) as Total|eval average=Total/Linecount|fields x average median
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@venkatesh296 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...