Splunk Search

How to merge 2 search in one search?

jip31
Motivator

Hello

I use 2 separate search almost identical

Now I want to merge these 2 search in one search

Here is the search

 

index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h 
| fields citrtt s 
| bin span=1h _time 
| search citrtt > 150 
| stats count as PbPerf by s _time 
| search PbPerf >= 2 
| timechart dc(s) as s span=1h 
| where _time < now() 
| eval time = strftime(_time, "%H:%M") 
| stats sum(s) as nbs by time 
| rename time as Heure

 

 

 

index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h 
| fields citnet s
| bin span=1h _time 
| search citnet > 80
| stats count as PbPerf by s _time 
| search PbPerf >= 2 
| timechart dc(s) as s span=1h 
| where _time < now() 
| eval time = strftime(_time, "%H:%M") 
| stats sum(s) as nbs by time  
| rename time as Heure

 

could you help please?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h 
| fields citrtt citnet s 
| bin span=1h _time 
| stats count(eval(citrtt > 150)) as citrrt_count count(eval(citnet > 80)) as citnet_count by s _time
| stats count(eval(citrtt_count > 2)) as citrtt_s_count count(eval(citnet_count > 2)) as citnet_s_count by _time
| where _time < now() 
| eval time = strftime(_time, "%H:%M") 
| stats sum(citrtt_s_count) as nbs_citrtt sum(citnet_s_count) as nbs_citnet by time 
| rename time as Heure

View solution in original post

0 Karma

SanjayReddy
SplunkTrust
SplunkTrust

Hi @jip31 

please use this

index=toto sourcetype IN ("cit","ezoptima:cit") type=* earliest=@d+7h latest=@d+19h
| fields citrtt citnet s
| bin span=1h _time
| search citrtt > 150 AND citnet > 80
| stats count as PbPerf by s _time
| search PbPerf >= 2
| timechart dc(s) as s span=1h
| where _time < now()
| eval time = strftime(_time, "%H:%M")
| stats sum(s) as nbs by time
| rename time as Heure

0 Karma

jip31
Motivator

hi

pearhaps I am not enough clear but I need to have 2 sum results for citrtt > 150 AND citnet > 80

for example :  time, citrtt, citnet

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h 
| fields citrtt citnet s 
| bin span=1h _time 
| stats count(eval(citrtt > 150)) as citrrt_count count(eval(citnet > 80)) as citnet_count by s _time
0 Karma

jip31
Motivator

ther eis an issue with the field nbs_citrtt which is never calculated even if I change the threshold 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There was a typo in the solution (corrected in later solutions)

| stats count(eval(citrtt > 150)) as citrtt_count count(eval(citnet > 80)) as citnet_count by s _time
0 Karma

jip31
Motivator

OK but I need to timechart the "s" events for citrtt and citnet after the stats command like in my example, so it's not enough

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This requirement is not enough to determine the solution - for example, do you want to count unique s where citrtt > 2 AND citnet > 2 or count unique s where citrtt > 2 OR citnet > 2?

0 Karma

jip31
Motivator

I want to count unique s where citrtt > 2 OR citnet > 2

but like I said I need to timechart the s events for the citrtt and citnet so I dont know how is it possible

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

That is still not clear enough - do you want a single count per hour of unique s where either count is greater than 2 or do you want two counts per hour of unique s where the corresponding count is greater than 2?

0 Karma

jip31
Motivator

two counts per hour of unique s where the corresponding count is greater than 2

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=toto sourcetype="cit" type=* earliest=@d+7h latest=@d+19h 
| fields citrtt citnet s 
| bin span=1h _time 
| stats count(eval(citrtt > 150)) as citrrt_count count(eval(citnet > 80)) as citnet_count by s _time
| stats count(eval(citrtt_count > 2)) as citrtt_s_count count(eval(citnet_count > 2)) as citnet_s_count by _time
| where _time < now() 
| eval time = strftime(_time, "%H:%M") 
| stats sum(citrtt_s_count) as nbs_citrtt sum(citnet_s_count) as nbs_citnet by time 
| rename time as Heure
0 Karma

jip31
Motivator

now it works ;-), thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please be more specific about what you are trying to do with the merged search as this will help determine the solution.

0 Karma

jip31
Motivator

I need to display the number of citrtt and the number of citnet for each bin span _time

time, citrtt, citnet

example : 7h,  25, 8

                     8h, 43, 7

etc....

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...