Splunk Search

I want to merge my data into single row, also I want to add the trendchart based on the date/time, please check below the more details.

New Member

index="indexsplunk" host=host* tag="Failure" "Transaction" | stats count as Total
|append [search index="indexsplunk" host=host* tag="Failure" "EFGH" | stats count as Total]

Right now, output is displaying in 2 rows, since I append so one more row added for 2nd search. Please help me getting the data populated in one field and also suggest how to add the date while searching.

0 Karma

SplunkTrust
SplunkTrust

try this:

(index="indexsplunk" host=host* tag="Failure" "Transaction" ) OR (index="indexsplunk" host=host* tag="ABCD" "EFGH") 
| stats count(eval(tag=="Failure")) as fail_count count(eval(tag=="ABCD")) as adcd_count
0 Karma

New Member

Hi, it gives me the 0 result, actually tag is common for both, can you please check again.

0 Karma

SplunkTrust
SplunkTrust

try and use this formula, here i use wild cards in eval %Fail% you might not need.

| makeresults count=1000
| eval randomfortext = random()%2
| eval texttosearch = if(randomfortext=="0","Failure","EFGH")
| stats count(eval(like(texttosearch,"%Fail%"))) as failcount count(eval(like(texttosearch, "%EF%"))) as efghcount

in your case itll be maybe something like this:
index="indexsplunk" host=host* tag="Failure" "Transaction" ("Failure" OR "EFGH")
| stats count(eval(like(raw,"Failure"))) as failcount count(eval(like(raw, "EFGH"))) as efghcount
hope it helps

0 Karma

Contributor

Do the two rows have anything in common?

0 Karma

New Member

Yes, Index, Host and Tag are common, please help

0 Karma