Splunk Search

multisearch in table format

shashidharh
Explorer

Hi,

I was trying to add 2 searches

 

 

 

| multisearch [search host=p-css* SRCreateRequest 400 | stats count as CreateSR 
            | appendcols [search host=p-css* SRUpdateRequest 400 | stats count as UpdateSR]
            | appendcols [search host=p-css*  SREscalateRequest 400 | stats count as EscalateSR]
            | appendcols [search host=p-css*  SRCloseRequest 400 | stats count as CloseSR]
            | eval type="400"]
	  [appendcols search host=p-css* SRCreateRequest Publisher: Completed | stats count as CreateSR 
            | appendcols [search host=p-css* SRUpdateRequest Publisher: Completed | stats count as UpdateSR]
            | appendcols [search host=p-css*  SREscalateRequest Publisher: Completed | stats count as EscalateSR]
            | appendcols [search host=p-css*  SRCloseRequest Publisher: Completed | stats count as CloseSR]
 | eval type="Completed"]
| chart count(Name) over 400 by Completed

 

 

 

Getting error "Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)."

 

My expected output  will be having a table format:

giving some example here

API400Completed
CreateSR3050
UpdateSR525
CloseSR2430
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Appendcols is not a streaming command and cannot be used in multisearch.

---
If this reply helps you, Karma would be appreciated.
0 Karma

shashidharh
Explorer

ohk, what could be the good solution for this query to get above result ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends what your data looks like!

Assuming you have fields API, status, publisher and completed, 

host=p-css* (SRCreateRequest OR SRUpdateRequest OR SREscalateRequest OR SRCloseRequest) (400 OR (Publisher: AND Completed))
| eval fourhundred=if(status=400, 1, 0)
| eval complete=if(publisher="Publisher:" AND completed="Completed", 1, 0)
| stats sum(fourhundred) as "400" sum(complete) as Completed by API

 

0 Karma

shashidharh
Explorer

yes, it is not giving the output..

but modified as below .. here all APIs are not showing along with "Completed"

anything wrong ?

Nov19.PNG

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There doesn't appear to be anything wrong, the absence of Completed and the other APIs from the results probably means they are absent from the events in your selected time period.

0 Karma

shashidharh
Explorer

hm yes, is it possible to display those columns & rows where we have "zero" values ?

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...