Splunk Search

multisearch in table format

shashidharh
Explorer

Hi,

I was trying to add 2 searches

 

 

 

| multisearch [search host=p-css* SRCreateRequest 400 | stats count as CreateSR 
            | appendcols [search host=p-css* SRUpdateRequest 400 | stats count as UpdateSR]
            | appendcols [search host=p-css*  SREscalateRequest 400 | stats count as EscalateSR]
            | appendcols [search host=p-css*  SRCloseRequest 400 | stats count as CloseSR]
            | eval type="400"]
	  [appendcols search host=p-css* SRCreateRequest Publisher: Completed | stats count as CreateSR 
            | appendcols [search host=p-css* SRUpdateRequest Publisher: Completed | stats count as UpdateSR]
            | appendcols [search host=p-css*  SREscalateRequest Publisher: Completed | stats count as EscalateSR]
            | appendcols [search host=p-css*  SRCloseRequest Publisher: Completed | stats count as CloseSR]
 | eval type="Completed"]
| chart count(Name) over 400 by Completed

 

 

 

Getting error "Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)."

 

My expected output  will be having a table format:

giving some example here

API400Completed
CreateSR3050
UpdateSR525
CloseSR2430
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Appendcols is not a streaming command and cannot be used in multisearch.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

shashidharh
Explorer

ohk, what could be the good solution for this query to get above result ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends what your data looks like!

Assuming you have fields API, status, publisher and completed, 

host=p-css* (SRCreateRequest OR SRUpdateRequest OR SREscalateRequest OR SRCloseRequest) (400 OR (Publisher: AND Completed))
| eval fourhundred=if(status=400, 1, 0)
| eval complete=if(publisher="Publisher:" AND completed="Completed", 1, 0)
| stats sum(fourhundred) as "400" sum(complete) as Completed by API

 

0 Karma

shashidharh
Explorer

yes, it is not giving the output..

but modified as below .. here all APIs are not showing along with "Completed"

anything wrong ?

Nov19.PNG

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There doesn't appear to be anything wrong, the absence of Completed and the other APIs from the results probably means they are absent from the events in your selected time period.

0 Karma

shashidharh
Explorer

hm yes, is it possible to display those columns & rows where we have "zero" values ?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>