Splunk Search

Report from multiple indexes

Path Finder

I need to create a report based on three different search criteria from three different sources. But since its a reconciliation report from three different systems, I need to make sure I present it in one report itself.

index=abc host="server-abc*" "upload succeeded" env=prd 

index=klm host="server-klm*" "index file" "*_prd.xml" 

index=xyz host="server-xyz*" "file uploaded" "Status code  : {}200"

The output/report I am trying to achieve is -

Index   Count
abc    100
klm       89
xyz     98

Will appreciate your ideas to achieve this.

Tags (4)
0 Karma


Try this

( index=abc host="server-abc*" "upload succeeded" env=prd ) OR ( index=klm host="server-klm*" "index file" "*_prd.xml" ) OR ( 
 index=xyz host="server-xyz*" "file uploaded" "Status code  : {}200") | stats count by index
0 Karma

Path Finder

Thank tiagofbmm and what if I need to give another name to each index. Like instead of "abc", if I want to show custom name like "Indexer1" and so on?

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...