Splunk Search

Merge results of two different searches

christo16
Explorer

Hello! I have two fields named differently, containing the same data, that I would like to merge.

I'd like to basically merge the results of these two separate searches to one result:
1) index= sourcetype= | stats count by client_ver
2) index= sourcetype= | stats count by Version

Is this possible?

Tags (1)

christo16
Explorer

Thanks for asking. So the data in both client_var and version is the same. We changed the field name at some point. Does this make sense?

0 Karma

sideview
SplunkTrust
SplunkTrust

How would you like the final data to be merged? There are several ways. For instance would you like three fields: Version, count (as client), count (as server)?
or does the distinction of client vs not-client not really matter and you just want an overall count of the versions regardless of whether the value was a client version or not?

0 Karma

christo16
Explorer

The source index and types are the same

0 Karma

sideview
SplunkTrust
SplunkTrust

Well.. it depends on some more details. Like whether the indexes and sourcetypes are the same in the two searches, and what you want the final output of the single search to look like.

If the indexes and sourcetypes are the same in the two searches, then

index=<some_index> sourcetype=<some_source> | stats count by client_ver Version

will give you one result with all the unique combinations of client_ver and Version.

If you're asking because you want to feed one search result to two different charts or tables on a dashboard, you would use 'postprocess' searches to carve this larger unified result into two different chartable results. Those 'postprocess' searches would each look like

| stats sum(count) as count by Version  

If the sourcetypes and indexes are different, then it's still very possible but you go about it a slightly different way. Can you post more details and I can update my answer as appropriate?

UPDATE-----------------------------

Ah! I see. it literally is exactly the same data and exactly the same space of field values, and it's just that the field name changed over time.

You can just use the eval command to normalize them at search time.

index=<some_index> sourcetype=<some_source> |  eval Version=coalesce(client_ver, Version) | stats count by Version

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!