Splunk Search

How to use results of stats command in other stats commands?

bollam
Path Finder

Hello,

I need some assistance on the following scenario.

Let's say I have a fields "Country" "cities" "command"

These are few events:

These are few cities of India.
Country=India, cities="Hyderabad, Bangalore, Kerala" command="common"

Country=Srilanka cities="Kandy, Colombo, Galle"

Country=Australia cities="Melbourne, sydney, Adelaide" command="common"

Country=USA cities="California, Cupertino, NewJersey"

Country=UK cities="Manchester, Headingley, Edgbaston" command="common"

Country=china cities="Beijing, Shanghai, Tianhe, common"

I have a sample query which gives me the result of source

index=sai_core sourcetype="city_log" command="common"
| makemv delim="," cities
| stats values(cities) as cities by source

I want to make use of these results of source to use as a group by for another search.

 index=sai_core sourcetype="city_log"
| makemv delim="," cities
| stats values(cities) as cities by source

How do I do this?

Tags (1)
0 Karma

macadminrohit
Contributor

Not sure if i could understand what your exact requirement is . Can you explain what you need exactly, the first search is pretty straight forward and you have already built it, show me the desired out after the second search . I tried to mimick using the dummy data, you could use the output to another search by using join or append

| makeresults 
| eval DATA="Country;India cities;Hyderabad,Bangalore,Kerala command;common:Country;Srilanka cities;Kandy,Colombo,Galle:Country;Australia cities;Melbourne,sydney,Adelaide command;common:Country;USA cities;California,Cupertino,NewJersey:Country;UK cities;Manchester,Headingley,Edgbaston command;common:Country;china cities;Beijing,Shanghai,Tianhe" 
| makemv DATA delim=":" 
| mvexpand DATA 
| makemv DATA delim=" " 
| eval Country=mvindex(DATA,0) 
| eval Cities=mvindex(DATA,1) 
| eval Command=mvindex(DATA,2) 
| fields Cities Command Country _time 
| rex field=Cities "cities\;(?P<Cities>.*)" 
| makemv Cities delim="," 
| mvexpand Cities 
| rex field=Command "command\;(?P<Command>.*)"  
| rex field=Country "Country\;(?P<Country>.*)" | stats values(Cities) as Cities by Country | mvexpand Cities
0 Karma

niketn
Legend

@bollam seems like a use case for Post Processing. However, you would need to create the same depending on what is your another search. So please refer the documentation with examples. Also ensure that you understand Post Processing Best practices.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...