Splunk Search
Highlighted

If I have two different searches without common fields, how can combine them and display a single result?

Builder

I got a strange situation here. I have two different searches as follows.

search 1:

index=* [ search index=_internal os=Windows sourcetype=splunkd 
| stats count by hostname 
| rename hostname as host 
| fields host ] 
| stats values(source) as sources by host

Which displays all the Windows hosts and sources of them for all the indexes.

And I have another search as follows which displays the results including Windows and also other operating systems which satisfies the same search condition.

search 2:

index=* | regex _raw!=".2016-\d{2}-\d{2}." | stats values(sources) as sources by host

Now I'm looking to write a search which displays the search 2 results from only the Windows hosts..I'm not sure if we have to include the search 1 for getting required result?

Any suggestions would be great and points will be awarded for the best answer

0 Karma
Highlighted

Re: If I have two different searches without common fields, how can combine them and display a single result?

Legend

Try this

index=* 
[ search index=_internal os=Windows sourcetype=splunkd 
  | stats count by hostname 
  | rename hostname as host 
  | fields host ] 
| regex _raw!=".2016-\d{2}-\d{2}." 
| stats values(source) as sources by host

View solution in original post

0 Karma
Highlighted

Re: If I have two different searches without common fields, how can combine them and display a single result?

Builder

what if I want to display all the sourcetypes too for each host besides the sources?

0 Karma
Highlighted

Re: If I have two different searches without common fields, how can combine them and display a single result?

Legend

You can add that too. Like this

 index=* 
 [ search index=_internal os=Windows sourcetype=splunkd 
   | stats count by hostname 
   | rename hostname as host 
   | fields host ] 
 | regex _raw!=".2016-\d{2}-\d{2}." 
 | stats values(source) as sources values(sourcetype) as sourcetypes by host
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.