Splunk Search

help me with Real time search for my usecase

Path Finder

I am trying to run real time for the below query(20 minute window) where
i can able to see only one result(i.e., count belongs to abc.com).

for remaining both pqr and xyz i can't see results for real time. but for Relative time i can see results for all of them.
Please help me in fixing this.

index=abc

| timechart span=1m count as "abc.com"
| appendcols [search index=pqr

| timechart span=1m count as "pqr.com"]
| appendcols [search index=xyz

| timechart span=1m count as "xyz.com"]

0 Karma
1 Solution

Legend

Hi sravankaripe,
why you don't run something like this (surely faster!):

index=abc OR index=pqr OR index=xyz 
| timechart span=1m count by index
| eval index=case(index="abc","abc.com",index="pqr","pqr.com",index="xyz","xyz.com")

Bye.
Giuseppe

View solution in original post

0 Karma

Legend

Hi sravankaripe,
why you don't run something like this (surely faster!):

index=abc OR index=pqr OR index=xyz 
| timechart span=1m count by index
| eval index=case(index="abc","abc.com",index="pqr","pqr.com",index="xyz","xyz.com")

Bye.
Giuseppe

View solution in original post

0 Karma

Path Finder

the query which i have posted is sample query .
but my real query have dedup, transaction and some rex command.

i can not use the above this query for my usecase.

0 Karma

Legend

Ok try something like this:
index=abc | your all your elaborations.....
| append [search index=pqr | your all your elaborations.....]
| append [search index=xyz | your all your elaborations.....]
| timechart span=1m count by index
| eval index=case(index="abc","abc.com",index="pqr","pqr.com",index="xyz","xyz.com")

Bye.
giuseppe

0 Karma

SplunkTrust
SplunkTrust

@sravankaripe @cusello...

append command will not give correct results for real-time searches. Maybe you have seeing something similar for appendcols.

Further, transaction will not work once you have used append. Refer to Splunk documentation below:
http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join#Alternative_commands

So in order for us to assist you. You would need to provide more details of your query and also why it has to run in realtime and can not run in historical time with refresh every 20 min?

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Motivator

I am assuming you want to have a realtime count for all three indexes? This can be achieved with this query:

index=abc OR index=pqr OR index=xyz | timechart span=1m count by index | rename abc as "abc.com" pqr as "pqr.com" xyz as "xyz.com"
0 Karma

Path Finder

the query which i have posted is sample query .
but my real query have dedup, transaction and some rex command.

i can not use the above this query for my usecase.

0 Karma