Splunk Search

How to match at least one field from separate events but the same source file?

dmoberg
Path Finder

We have a log file that is split into multiple events. In these events we need to count the number of occurrences where Event XXX > 0 and Event YYY > 0 for each Source file. So finding 1 match of XXX and YYY in one particular Source file would be counted as 1 for this purpose.

Splunk search:

SEARCH (patterns matching Events of type A) OR (patterns matching Events of type B) | eval isDEP=if(match(NAME, "(?i).*(XXX).*"), 1, 0) | eval isPERF=if(match(NAME, ".*(YYY).*"), 1, 0) | stats list(NAME),list(isDEP),list(isPERF),count by source

In the Search part of the query I find the type of Events of interest, then determine the count of matches for XXX and YYY. This works fine, the problem is that I do not know how to tell Splunk to give me:

If XXX > 0 AND YYY > 0 for a particular Source file (aggregate by Source), then count this as 1.

This is an example output for the above query:

dmoberg_0-1685025538091.png

The issue seems to be that Splunk works on an "per Event" basis so each result is tied with the Event and not the Source file.

Any ideas on how to do this?

 

Labels (2)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

See if this helps

SEARCH (patterns matching Events of type A) OR (patterns matching Events of type B) 
| eval isDEP=if(match(NAME, "(?i).*(XXX).*"), 1, 0) 
| eval isPERF=if(match(NAME, ".*(YYY).*"), 1, 0) 
| stats list(NAME),sum(isDEP) as depCount, sum(isPERF) as perfCount, count by source
| where (depCount>1 AND perfCount>1)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

See if this helps

SEARCH (patterns matching Events of type A) OR (patterns matching Events of type B) 
| eval isDEP=if(match(NAME, "(?i).*(XXX).*"), 1, 0) 
| eval isPERF=if(match(NAME, ".*(YYY).*"), 1, 0) 
| stats list(NAME),sum(isDEP) as depCount, sum(isPERF) as perfCount, count by source
| where (depCount>1 AND perfCount>1)
---
If this reply helps you, Karma would be appreciated.

dmoberg
Path Finder

that worked! Not sure how I missed this. Thx!

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...