Splunk Search

help me with Real time search for my usecase

sravankaripe
Communicator

I am trying to run real time for the below query(20 minute window) where
i can able to see only one result(i.e., count belongs to abc.com).

for remaining both pqr and xyz i can't see results for real time. but for Relative time i can see results for all of them.
Please help me in fixing this.

index=abc

| timechart span=1m count as "abc.com"
| appendcols [search index=pqr

| timechart span=1m count as "pqr.com"]
| appendcols [search index=xyz

| timechart span=1m count as "xyz.com"]

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi sravankaripe,
why you don't run something like this (surely faster!):

index=abc OR index=pqr OR index=xyz 
| timechart span=1m count by index
| eval index=case(index="abc","abc.com",index="pqr","pqr.com",index="xyz","xyz.com")

Bye.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi sravankaripe,
why you don't run something like this (surely faster!):

index=abc OR index=pqr OR index=xyz 
| timechart span=1m count by index
| eval index=case(index="abc","abc.com",index="pqr","pqr.com",index="xyz","xyz.com")

Bye.
Giuseppe

View solution in original post

0 Karma

sravankaripe
Communicator

the query which i have posted is sample query .
but my real query have dedup, transaction and some rex command.

i can not use the above this query for my usecase.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Ok try something like this:
index=abc | your all your elaborations.....
| append [search index=pqr | your all your elaborations.....]
| append [search index=xyz | your all your elaborations.....]
| timechart span=1m count by index
| eval index=case(index="abc","abc.com",index="pqr","pqr.com",index="xyz","xyz.com")

Bye.
giuseppe

0 Karma

niketnilay
Legend

@sravankaripe @cusello...

append command will not give correct results for real-time searches. Maybe you have seeing something similar for appendcols.

Further, transaction will not work once you have used append. Refer to Splunk documentation below:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join#Alternative_commands

So in order for us to assist you. You would need to provide more details of your query and also why it has to run in realtime and can not run in historical time with refresh every 20 min?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

DMohn
Motivator

I am assuming you want to have a realtime count for all three indexes? This can be achieved with this query:

index=abc OR index=pqr OR index=xyz | timechart span=1m count by index | rename abc as "abc.com" pqr as "pqr.com" xyz as "xyz.com"
0 Karma

sravankaripe
Communicator

the query which i have posted is sample query .
but my real query have dedup, transaction and some rex command.

i can not use the above this query for my usecase.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!