Splunk Search

Use the value of my first search in my second search (append)

exchanger
Path Finder

Hello,

 

With Appendcols I now have both values in one line. However, I would like to compare the values with each other.
As an example:
"mysearch " stats dc(User) as User1 |
appendcols [search "my2search" |
stats dc(User) as User2 ]

Now as result I get
User1 User2
500     1000
Now I would like to compare the two values in the same query, for example multiply User1 with User2 or similar. How can I include this in the search?

 

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @exchanger,

You are almost there if I understood correctly;

"mysearch " stats dc(User) as User1 
| appendcols 
    [ search "my2search" 
    | stats dc(User) as User2 ]
| eval result=User1*User2
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

0 Karma

bowesmana
SplunkTrust
SplunkTrust

Just keep adding more commands as necessary, for example

 

"mysearch " 
| stats dc(User) as User1
| appendcols [
  search "my2search"
  | stats dc(User) as User2 ]
| eval MultiplyResult=User1 * User2
| eval WhichIsBigger=case(User1 > User2, "User1 is bigger", User2 > User1, 
 "User2 is bigger", 1==1, "The users are equal")

 

 Hope this helps

 

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @exchanger,

You are almost there if I understood correctly;

"mysearch " stats dc(User) as User1 
| appendcols 
    [ search "my2search" 
    | stats dc(User) as User2 ]
| eval result=User1*User2
If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...