Splunk Search

Join two field with similar values and stats by an uncommon field

Engager

How do I combine a field with similar value (where one value might or might not exist in one of the field) and use stats by with an uncommon field? I have the search below 

| tstats prestats=t summariesonly=t allow_old_summaries=t count from datamodel=Network_Resolution.DNS by "DNS.query"
| rename DNS.query as query1
| tstats append=t prestats=t summariesonly=t allow_old_summaries=t count from datamodel=Web.Web by _time Web.dest Web.category
| rename Web.dest as query2
| rename Web.category as category
| eval query=coalesce(query1,query2)
| stats count by query category
| fillnull value=NULL

 

Web.destWeb.categoryDNS.query
abc.comNewsabc.com
  dfe.com

 

Results:

querycategory
abc.comnews

 

Expected Results:

querycategory
abc.comnews
dfe.comNULL
Labels (4)
0 Karma
1 Solution

Ultra Champion

...

| fillnull value=NULL
| stats count by query category

The order is important.

View solution in original post

0 Karma

Ultra Champion

...

| fillnull value=NULL
| stats count by query category

The order is important.

View solution in original post

0 Karma

Engager

Omg thanks!

0 Karma