Splunk Search

Merging multiple indexers and providing report

runiyal
Path Finder

I need to create a report based on three different search criteria from three different sources. But since its a reconciliation report from three different systems, I need to make sure I present it in one report itself.

index=abc host="server-abc*" "upload succeeded" env=prd 

index=klm host="server-klm*" "index file" "*_prd.xml" 

index=xyz host="server-xyz*" "file uploaded" "Status code  : {}200"

The output/report I am trying to achieve is -

   Index    Count
    abc    100
    klm       89
    xyz     98

Will appreciate your ideas to achieve this.

Tags (3)
0 Karma

adonio
Ultra Champion
(index=abc host="server-abc*" "upload succeeded" env=prd) OR

(index=klm host="server-klm*" "index file" "*_prd.xml")  OR

 (index=xyz host="server-xyz*" "file uploaded" "Status code  : {}200")

| stats count by index
0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...