Splunk Search

Need to print 2 counts with different time intervals

bapun18
Communicator

Hi Team,
I need to use print two values from an index with different earliest values. please find the below example.

index=abcd cust_name="*" earliest=-30d@d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as MAU by Customer
| appendcols
[ search index=abcd cust_name="*" earliest=-14d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as DAU by Customer
| eval DAU=round(DAU/14,2)
]


My problem is I am using two earliest values so in my first earliest value I have a customer count of 57 and on the second earliest value customer count is 43, so while printing both the values it's printing the wrong value in one column.

Labels (1)
Tags (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Appendcols puts the results in order without correlating with the common column

To check this, you could alter your search like this

index=abcd cust_name="*" earliest=-30d@d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as MAU by Customer
| eval MAU=Customer.":".MAU
| appendcols
[ search index=abcd cust_name="*" earliest=-14d
| fields cust_name,origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID
| eval id =coalesce(origUserid,destUserid,finalCalledPartyUnicodeLoginUserID,callingPartyUnicodeLoginUserID)
| rename cust_name as Customer
| dedup id
| stats count(id) as DAU by Customer
| eval DAU=round(DAU/14,2)
| eval DAU=Customer.":".DAU
]

bapun18
Communicator

Yeah but this can be a way but, client isn't happy with it they need data like customer in one column and rest values each per column.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you give an example/mock up of what your customer would like it to look like?

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...