Splunk Search
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

club 3 search queries into 1

BMUDGAL1190
New Member
‎03-28-2019 07:09 AM

I have given the query below. I am trying to display all 3 RERs- RERa, RERb, RERc. But this is displaying just RERb and RERc. RERa is not getting displayed. Is there any limitation on appendcols iteration? Or if anyone has some suggestion how I can accomplish what I need.

index=cba_mainframe AND MSGTXT = "*RC=0000*" AND JOBNAME=P6435COY OR JOBNAME=P6435CON|stats count AS total 
|appendcols [search 
|head 1
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m") 
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RERa=case(Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time2 AND Time1 < Time3),"100", 
               Week_DAY=3 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"0", 
               Week_DAY=4 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0"
                                              )]
|stats values(RERa) as RER1
|appendcols [search index=cba_mainframe AND MSGTXT = "*RC=0000*" AND JOBNAME=P6435SEF OR JOBNAME=P6435SEE
|head 1
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m") 
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RERb=case(Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time6 AND Time1 < Time7),"100", 
               Week_DAY=3 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"0",
               Week_DAY=4 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0"
                                              )
]|stats values(RERb) AS RER2
|appendcols
[search index=cba_mainframe AND MSGTXT = "*RC=0000*" AND JOBNAME=P6435GEF OR JOBNAME=P6435GEE
|head 1
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m") 
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RERc=case(Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time8 AND Time1 < Time9),"100", 
               Week_DAY=3 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"0",
               Week_DAY=4 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0"
                                              )
]
|table RER2 RERc RER1 
|eval RER=(RERc+RER2+RER1)/3
Tags (3)
0 Karma
Reply

somesoni2
Revered Legend
‎03-28-2019 11:51 AM

Give this a try

index=cba_mainframe MSGTXT="*RC=0000*"  (JOBNAME="P6435COY" OR JOBNAME="P6435CON") OR (JOBNAME="P6435SEF" OR JOBNAME="P6435SEE") OR (JOBNAME="P6435GEF" OR JOBNAME="P6435GEE")
| eval dedupField=case(JOBNAME="P6435COY" OR JOBNAME="P6435CON", "type1",JOBNAME="P6435SEF" OR JOBNAME="P6435SEE", "type2" , true(), "type3" )
| dedup dedupField
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m") 
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RER1=case(dedupField!="type1", null(), Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time2 AND Time1 < Time3),"100", 
               Week_DAY=3 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"0", 
               Week_DAY=4 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0" )
|eval RER2=case(dedupField!="type2", null(), Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time6 AND Time1 < Time7),"100", 
               Week_DAY=3 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"0",
               Week_DAY=4 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0" )
|eval RERc=case(dedupField!="type3", null(), Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time8 AND Time1 < Time9),"100", 
               Week_DAY=3 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"0",
               Week_DAY=4 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0" )
| stats values(RER1) as RER1 values(RER2) as RER2 values(RERc) as RERc
|eval RER=(RERc+RER2+RER1)/3
0 Karma
Reply

skoelpin
SplunkTrust
SplunkTrust
‎03-28-2019 08:05 AM

Why append 3 searches from the same index? You need to join all 3 searches into a single base search with an OR

0 Karma
Reply
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...