Splunk Search

how to Union 4 searches with 4 field name

splunkt0n
New Member

Hi,

Good day!

have this search:

| union 
    [| pivot latest(field0) AS field0 SPLITROW field4 AS field4 
    | search field0="Success" 
    | stats count as field3 by field1,field2 
    | addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ] 
    [| pivot latest(field0) AS field0 SPLITROW field4 AS field4 
    | search field0="Failed" 
    | stats count as field3 by field1,field2 
    | addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ] 
    [| pivot latest(field0) AS field0 SPLITROW field4 AS field4 
    | search field0="Warning" 
    | stats count as field3 by field1,field2 
    | addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ]

and I want my result to look like this.
alt text

Hope you can help me and thanks in advance!

Tags (2)
0 Karma

mayurr98
Super Champion

can you try this

| pivot latest(field0) AS field0 SPLITROW field4 AS field4 
| search field0="Success" 
| stats count as field3 by field1,field2 
| addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ] 
| append 
[| pivot latest(field0) AS field0 SPLITROW field4 AS field4 
| search field0="Failed" 
| stats count as field3 by field1,field2 
| addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ] 
| append 
[| pivot latest(field0) AS field0 SPLITROW field4 AS field4 
| search field0="Warning" 
| stats count as field3 by field1,field2 
| addtotals row=f col=t labelfield="field2" label="Grand Total" field3 ]
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) v3.54.0

The Splunk Threat Research Team (STRT) recently released Enterprise Security Content Update (ESCU) v3.54.0 and ...

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...