Splunk Search

How to merge 2 fields and get unique value

dyapasrikanth
Path Finder

We have prod and non prod events and trying to display the environment names in dashboard. The prod events contain hostname and I can extract the environment name from it, where as non prod environment name comes from different field (kubernetes.namespace_name). How can I merge these 2 fields.

Prod

index=test_prod hostname=ab_bc-app1-prod-i-08077b980050dbd11 sometext

Non Prod

index=test_nonprod hostname=nonprod-i-4332 sometext kubernetes.namespace_name=np1

I have 2 different queries to get the environment name out of them

search index=test_prod  appname=* | rex field=host "ab_bc-[^-]*-(?P<env>[^-]*)-" | stats values(env) as env
search index=test_nonprod appname=* kubernetes.namespace_name!=null  | stats values(kubernetes.namespace_name) as env

I tried to merge these 2 queries but not getting the expected output

index=test_*  appname=* | rex field=host "ab_bc-[^-]*-(?P<env>[^-]*)-" | rename kubernetes.namespace_name as env | stats values(env)

But I am getting only prod environments but not non prod. Whats wrong I am doing?

0 Karma

dyapasrikanth
Path Finder

Some how this query working.

index=test_*  appname=* | rename kubernetes.namespace_name as env | rex field=host "ab_bc-[^-]*-(?P<env>[^-]*)-" | sort env | dedup env | stats count by env
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, please accept an answer to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try coalesce.

index=test_*  appname=* | rex field=host "ab_bc-[^-]*-(?P<env>[^-]*)-" | eval env=coalesce(env, kubernetes.namespace_name)
---
If this reply helps you, Karma would be appreciated.
0 Karma

dyapasrikanth
Path Finder

No it didn't work, it is giving only prod environments

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...