three search in same page with alert and time span=3 month

[logloganathan]

i want to do three different search in same page for time span is 3 month
i need a alert to be configured

[niketn · Accepted solution]

@logloganathan you should explore the multisearch command which is not restricted by sub-search limitations

| multisearch 
    [search index=A sourcetype=B XXX=*]
    [search index=A sourcetype=B YYY=*]
    [search index=A sourcetype=B ZZZ=*]
| stats count by XXX YYY ZZZ

However, Splunk has numerous event grouping and correlation mechanisms based on the Use Cases and we can not always apply any one of the correlation mechanism for all the scenarios.

So you should elaborate on what exactly is your use case. If you are planning to pull 3 months of data to create an alert, could you rely on summary indexing instead? Community would be able to assist you better you add more context to your questions like what is your use case, what does your data look like? What have you tried so far and what does not seem to work?

I dont think a doctor should treat patient based on hunch rather the cure should be based upon symptoms!!! So for us to help you better add as much of details as possible to your questions 🙂

[logloganathan]

I can provide only example use cases..i can't provide organization data..i already provided example query I just need output for that and i got it from you..thanks for that

[niketn]

I am glad you are able to resolve the issue that you are facing. Yes we understand that organization data can not be published on public forums, however, usually request here on Splunk Answers is for mocked/anonymized data. In fact most of the times if sensitive information is posted accidentally by folks, community moderators do reach out to them for masking/anonymizing the same.

Following is an example of anonymized data in similar format to how original event might have triggered in the system, but without revealing any sensitive information.

2017/01/12 08:09:04.325 AM [ERROR] Login failed for abc@def.com on server servername01@domain.com.

Having said that I am still curious on the use case for pulling 3 months data for an alert. It is up to you whether you want to post the use case or not since your issue is already resolved! 🙂

[p_gurav]

did you try usingappend command?

index=A sourectype=B "XXX" | stats count by XXX |append [search index=A sourectype=B "YYY" | stats count by YYY] | append [search index=A sourectype=B "ZZZ" | stats count by ZZZ]

[logloganathan]

thanks..please post this in answer tab

[kmaron]

Can you please provide more information.
What are you searching for? What are your searches? Is this a dashboard? What do you want to alert on?

[logloganathan]

no its not dashboard i want to do search to find 3 data count..all are different.
is there any way to do that apart from dashboard?

[p_gurav]

Is your alert depend on output of 3 different searches? Can you share your searches and alert conditions ?

[kmaron]

you need to provide more information
please give examples of the events you're searching and explain what counts you want

[logloganathan]

yes..
index=A sourectype=B "XXX" | stats count by XXX
index=A sourectype=B "YYY" | stats count by YYY
index=A sourectype=B "ZZZ" | stats count by ZZZ

i want these three table in one page and alert configured for this

[logloganathan]

any update?