How to match at least one field from separate events but the same source file?

[dmoberg]

We have a log file that is split into multiple events. In these events we need to count the number of occurrences where Event XXX > 0 and Event YYY > 0 for each Source file. So finding 1 match of XXX and YYY in one particular Source file would be counted as 1 for this purpose.

Splunk search:

SEARCH (patterns matching Events of type A) OR (patterns matching Events of type B) | eval isDEP=if(match(NAME, "(?i).*(XXX).*"), 1, 0) | eval isPERF=if(match(NAME, ".*(YYY).*"), 1, 0) | stats list(NAME),list(isDEP),list(isPERF),count by source

In the Search part of the query I find the type of Events of interest, then determine the count of matches for XXX and YYY. This works fine, the problem is that I do not know how to tell Splunk to give me:

If XXX > 0 AND YYY > 0 for a particular Source file (aggregate by Source), then count this as 1.

This is an example output for the above query:

The issue seems to be that Splunk works on an "per Event" basis so each result is tied with the Event and not the Source file.

Any ideas on how to do this?

[richgalloway · Accepted solution]

See if this helps

SEARCH (patterns matching Events of type A) OR (patterns matching Events of type B) 
| eval isDEP=if(match(NAME, "(?i).*(XXX).*"), 1, 0) 
| eval isPERF=if(match(NAME, ".*(YYY).*"), 1, 0) 
| stats list(NAME),sum(isDEP) as depCount, sum(isPERF) as perfCount, count by source
| where (depCount>1 AND perfCount>1)

[dmoberg]

that worked! Not sure how I missed this. Thx!