Splunk Search

Use two stats function with different group by

rj
Loves-to-Learn Lots


how to get this two stats result in one query


(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))

| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq (this dq field is not present in ho_sum)

| stats latest(first) as first_vu
latest(last) as last_vu
latest(index) as index_1
by dev_id sourcetype

Labels (3)
0 Karma

rj
Loves-to-Learn Lots

thankyou for the reply ,is there is any other way of doing it 

0 Karma

skramp
SplunkTrust
SplunkTrust

You can try this, but I don't know if that is the solution you need:

(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| fillnull dq
| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq sourcetype

0 Karma

rj
Loves-to-Learn Lots

yes ,i have two different searches ,but i need to use  output of one filed and to use in another

0 Karma

skramp
SplunkTrust
SplunkTrust

Then my solution seams to solve your problem. Have you tried to let it run like my suggestion was? Put the whole text (both blocks) into your search bar. 

0 Karma

skramp
SplunkTrust
SplunkTrust

(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq (this dq field is not present in ho_sum)

| append [search (earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv"))) 
| stats latest(first) as first_vu
latest(last) as last_vu
latest(index) as index_1
by dev_id sourcetype]

Here you have one query but two searches but one result set. Using it this way isn't that nice because as mentioned you have two separate searches.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...