Splunk Search

Looking for a faster search query: Count different platforms from somewhat same events

Bleepie
Communicator

Dear Splunk Community,

I have the following search:

 

index=websphere 200 OK POST 

 

And I have different platforms that I find like this:

 

index=websphere 200 OK POST LINUX
index=websphere 200 OK POST Windows
index=websphere 200 OK POST zLinux

 

I am currently using the following query to count all 200 OK POST events per platform:

 

index=websphere 200 OK POST LINUX | stats count | rename count AS "Linux" | append [search index=websphere 200 OK POST WINDOWS | stats count | rename count AS "Windows"] | append [search index=websphere 200 OK POST ZLINUX | stats count | rename count AS "zLinux"] 

 

This is just an example, I have way more platforms that I search like in the query above. I have two issues:

  • Its slow
  • It counts per platform and generates table headers horizontally that I don't want

Bleepie_0-1633610704587.png

I would like to change the above so that I get the following output:

Platform | Count

Linux | 24

Windows | 50

zLinux | 0

Also, using append search seems a bit devious. There must be a simpler, faster and better way to do this, but how?

Thanks in advance

 

EDIT: Please note that the results are all shown in _raw , there are no platform fields or anything generated

Labels (4)
0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

index=websphere 200 OK POST (LINUX OR WINDOWS OR ZLINUX) | eval Platform=case(searchmatch("LINUX"),"LINUX", searchmatch("WINDOWS"),"WINDOWS", true(),"ZLINUX") | stats count by Platform

View solution in original post

0 Karma

somesoni2
Revered Legend

Try something like this

index=websphere 200 OK POST (LINUX OR WINDOWS OR ZLINUX) | eval Platform=case(searchmatch("LINUX"),"LINUX", searchmatch("WINDOWS"),"WINDOWS", true(),"ZLINUX") | stats count by Platform
0 Karma

Bleepie
Communicator

Thanks! Works like a charm! Not familiair with searchmatch but will look into it.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...