Splunk Search

How to use results of stats command in other stats commands?

bollam
Path Finder

Hello,

I need some assistance on the following scenario.

Let's say I have a fields "Country" "cities" "command"

These are few events:

These are few cities of India.
Country=India, cities="Hyderabad, Bangalore, Kerala" command="common"

Country=Srilanka cities="Kandy, Colombo, Galle"

Country=Australia cities="Melbourne, sydney, Adelaide" command="common"

Country=USA cities="California, Cupertino, NewJersey"

Country=UK cities="Manchester, Headingley, Edgbaston" command="common"

Country=china cities="Beijing, Shanghai, Tianhe, common"

I have a sample query which gives me the result of source

index=sai_core sourcetype="city_log" command="common"
| makemv delim="," cities
| stats values(cities) as cities by source

I want to make use of these results of source to use as a group by for another search.

 index=sai_core sourcetype="city_log"
| makemv delim="," cities
| stats values(cities) as cities by source

How do I do this?

Tags (1)
0 Karma

macadminrohit
Contributor

Not sure if i could understand what your exact requirement is . Can you explain what you need exactly, the first search is pretty straight forward and you have already built it, show me the desired out after the second search . I tried to mimick using the dummy data, you could use the output to another search by using join or append

| makeresults 
| eval DATA="Country;India cities;Hyderabad,Bangalore,Kerala command;common:Country;Srilanka cities;Kandy,Colombo,Galle:Country;Australia cities;Melbourne,sydney,Adelaide command;common:Country;USA cities;California,Cupertino,NewJersey:Country;UK cities;Manchester,Headingley,Edgbaston command;common:Country;china cities;Beijing,Shanghai,Tianhe" 
| makemv DATA delim=":" 
| mvexpand DATA 
| makemv DATA delim=" " 
| eval Country=mvindex(DATA,0) 
| eval Cities=mvindex(DATA,1) 
| eval Command=mvindex(DATA,2) 
| fields Cities Command Country _time 
| rex field=Cities "cities\;(?P<Cities>.*)" 
| makemv Cities delim="," 
| mvexpand Cities 
| rex field=Command "command\;(?P<Command>.*)"  
| rex field=Country "Country\;(?P<Country>.*)" | stats values(Cities) as Cities by Country | mvexpand Cities
0 Karma

niketn
Legend

@bollam seems like a use case for Post Processing. However, you would need to create the same depending on what is your another search. So please refer the documentation with examples. Also ensure that you understand Post Processing Best practices.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...