multiple sourcetype search and scoring

[DonDandrea]

I have been working on a search for a while and I am stumped.

I am searching two different source types. One value I am extracting is a stats count and the other is the sum of values from the other source type. I need to combine the results from the two based on a single field. The field exists in both source types but each has it's own name. If I do not rename it one of the two values is present. If I rename it then the other shows. I really need to get both of these values in and be able to run an eval on them to determine percentage to understand who is having the most problems using our software. The two fields that match are Agency and Agent.

index=dspro (sourcetype=telemetry(Version=PROD OR Version=BETA OR Version=ALPH)) OR (sourcetype=bootlogmaster (DSproSystem=Prod OR DSproSystem=Beta OR DSproSystem=Alph)) | rename Agent as Agency | stats sum(TotalTransactions) as transaction_count count(eval(sourcetype="bootlogmaster")) as error_count by Agency | eval percent=(error_count/transaction_count)*100 | sort by Agency

[lguinn2 · Accepted solution]

I would have expected the rename to work properly, but since it apparently didn't, try coalesce instead:

index=dspro (sourcetype=telemetry (Version=PROD OR Version=BETA OR Version=ALPH)) OR (sourcetype=bootlogmaster (DSproSystem=Prod OR DSproSystem=Beta OR DSproSystem=Alph)) 
| eval Agency=coalesce(Agency,Agent)
| stats sum(TotalTransactions) as transaction_count 
        count(eval(sourcetype="bootlogmaster")) as error_count by Agency 
| eval percent=(error_count/transaction_count)*100 
| sort by Agency

(BTW, it is entirely okay for a search to span multiple lines, just copy and paste this into the search box.)

[DonDandrea]

I would have never found this solution on my own since it is not in Splunk's List of search commands. I did a search and found documentation though. Thank you very much. I have been pulling my hair out trying to figure this out.

[DonDandrea]

dded the space and came up with the same result.
index=dspro (sourcetype=telemetry (Version=PROD OR Version=BETA OR Version=ALPH)) OR (sourcetype=bootlogmaster (DSproSystem=Prod OR DSproSystem=Beta OR DSproSystem=Alph)) | rename Agent as Agency | stats sum(TotalTransactions) as transaction_count count(eval(sourcetype="bootlogmaster")) as error_count by Agency | eval percent=(error_count/transaction_count)*100 | sort by Agency

[grijhwani]

Edited to format the search. Incidentally you appear to be missing a space after "telemetry".