Splunk Search

multisearch in table format

shashidharh
Explorer

Hi,

I was trying to add 2 searches

 

 

 

| multisearch [search host=p-css* SRCreateRequest 400 | stats count as CreateSR 
            | appendcols [search host=p-css* SRUpdateRequest 400 | stats count as UpdateSR]
            | appendcols [search host=p-css*  SREscalateRequest 400 | stats count as EscalateSR]
            | appendcols [search host=p-css*  SRCloseRequest 400 | stats count as CloseSR]
            | eval type="400"]
	  [appendcols search host=p-css* SRCreateRequest Publisher: Completed | stats count as CreateSR 
            | appendcols [search host=p-css* SRUpdateRequest Publisher: Completed | stats count as UpdateSR]
            | appendcols [search host=p-css*  SREscalateRequest Publisher: Completed | stats count as EscalateSR]
            | appendcols [search host=p-css*  SRCloseRequest Publisher: Completed | stats count as CloseSR]
 | eval type="Completed"]
| chart count(Name) over 400 by Completed

 

 

 

Getting error "Error in 'multisearch' command: Multisearch subsearches might only contain purely streaming operations (subsearch 1 contains a non-streaming command)."

 

My expected output  will be having a table format:

giving some example here

API400Completed
CreateSR3050
UpdateSR525
CloseSR2430
Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Appendcols is not a streaming command and cannot be used in multisearch.

---
If this reply helps you, Karma would be appreciated.
0 Karma

shashidharh
Explorer

ohk, what could be the good solution for this query to get above result ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It depends what your data looks like!

Assuming you have fields API, status, publisher and completed, 

host=p-css* (SRCreateRequest OR SRUpdateRequest OR SREscalateRequest OR SRCloseRequest) (400 OR (Publisher: AND Completed))
| eval fourhundred=if(status=400, 1, 0)
| eval complete=if(publisher="Publisher:" AND completed="Completed", 1, 0)
| stats sum(fourhundred) as "400" sum(complete) as Completed by API

 

0 Karma

shashidharh
Explorer

yes, it is not giving the output..

but modified as below .. here all APIs are not showing along with "Completed"

anything wrong ?

Nov19.PNG

 

 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

There doesn't appear to be anything wrong, the absence of Completed and the other APIs from the results probably means they are absent from the events in your selected time period.

0 Karma

shashidharh
Explorer

hm yes, is it possible to display those columns & rows where we have "zero" values ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...