Splunk Search

combining 2 searches - with dynamic urls into 1

super_edition
Path Finder

Hello Everyone,

I have 2 splunk search queries

query-1

index="my_index"  kubernetes_namespace="my_ns"  kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" "/my_service/user-registration"
| dedup req_id
| stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster
| eval avgResponse=round(avgResponse,2) 
| eval nintyPerc=round(nintyPerc,2)

output 

urlmethodkubernetes_clusterhitsavgResponsenintyPerc
/my_service/user-registrationPOSTLON11254112535

 

query-2

index="my_index"  kubernetes_namespace="my_ns"  kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" "/my_service/profile-retrieval"
| eval normalized_url="/my_service/profile-retrieval"
| stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by normalized_url method kubernetes_cluster
| eval avgResponse=round(avgResponse,2) 
| eval nintyPerc=round(nintyPerc,2)

output

urlmethodkubernetes_clusterhitsavgResponsenintyPerc
/my_service/profile-retrievalGETLON554776983423

 

The query-2 returns multiple urls like below but belongs to same endpoint:

/my_service/profile-retrieval/324524352

/my_service/profile-retrieval/453453?displayOptions=ADDRESS%2CCONTACT&programCode=SKW

/my_service/profile-retrieval/?displayOptions=PREFERENCES&programCode=SKW&ssfMembershipId=00408521260

Hence I used eval function to normalized them

eval normalized_url="/my_service/profile-retrieval"

How do I combine both queries to return as simplified output

urlmethodkubernetes_clusterhitsavgResponsenintyPerc
/my_service/user-registrationPOSTLON11254112535
/my_service/profile-retrievalGETLON554776983423

 

Highly appreciate your help!!

Labels (3)
0 Karma
1 Solution

PrewinThomas
Motivator

@super_edition 
You can either use append or eval match condition to combine both for your scenario

using append

(
index="my_index" kubernetes_namespace="my_ns" kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" "/my_service/user-registration"
| dedup req_id
| stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster
| eval avgResponse=round(avgResponse,2)
| eval nintyPerc=round(nintyPerc,2)
)
| append [
search index="my_index" kubernetes_namespace="my_ns" kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" "/my_service/profile-retrieval"
| eval url="/my_service/profile-retrieval"
| stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster
| eval avgResponse=round(avgResponse,2)
| eval nintyPerc=round(nintyPerc,2)
]
| table url method kubernetes_cluster hits avgResponse nintyPerc

 

combined

index="my_index" kubernetes_namespace="my_ns" kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" ("/my_service/user-registration" OR "/my_service/profile-retrieval")
| eval url=if(match(url, "^/my_service/user-registration"), "/my_service/user-registration",
if(match(url, "^/my_service/profile-retrieval"), "/my_service/profile-retrieval", url))
| dedup req_id
| stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster
| eval avgResponse=round(avgResponse,2)
| eval nintyPerc=round(nintyPerc,2)
| table url method kubernetes_cluster hits avgResponse nintyPerc

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @super_edition ,

you could try something like this (see my approach and adapt it to your data):

index="my_index"  kubernetes_namespace="my_ns"  kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" ("/my_service/user-registration" OR "/my_service/profile-retrieval")
| eval url=if(searchmatch("/my_service/profile-retrieval"),"/my_service/profile-retrieval","/my_service/user-registration")
| stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster
| eval avgResponse=round(avgResponse,2) 
| eval nintyPerc=round(nintyPerc,2)

Ciao.

Giuseppe

PrewinThomas
Motivator

@super_edition 
You can either use append or eval match condition to combine both for your scenario

using append

(
index="my_index" kubernetes_namespace="my_ns" kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" "/my_service/user-registration"
| dedup req_id
| stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster
| eval avgResponse=round(avgResponse,2)
| eval nintyPerc=round(nintyPerc,2)
)
| append [
search index="my_index" kubernetes_namespace="my_ns" kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" "/my_service/profile-retrieval"
| eval url="/my_service/profile-retrieval"
| stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster
| eval avgResponse=round(avgResponse,2)
| eval nintyPerc=round(nintyPerc,2)
]
| table url method kubernetes_cluster hits avgResponse nintyPerc

 

combined

index="my_index" kubernetes_namespace="my_ns" kubernetes_cluster!="bad_cluster" kubernetes_deployment_name="frontend_service" msg="RESPONSE" ("/my_service/user-registration" OR "/my_service/profile-retrieval")
| eval url=if(match(url, "^/my_service/user-registration"), "/my_service/user-registration",
if(match(url, "^/my_service/profile-retrieval"), "/my_service/profile-retrieval", url))
| dedup req_id
| stats count as hits avg(responseTime) as avgResponse perc90(responseTime) as nintyPerc by url method kubernetes_cluster
| eval avgResponse=round(avgResponse,2)
| eval nintyPerc=round(nintyPerc,2)
| table url method kubernetes_cluster hits avgResponse nintyPerc

Regards,
Prewin
Splunk Enthusiast | Always happy to help! If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

super_edition
Path Finder

Thanks @PrewinThomas -  it worked as expected and was fast enough.

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...