Splunk Search

three search in same page with alert and time span=3 month

logloganathan
Motivator

i want to do three different search in same page for time span is 3 month
i need a alert to be configured

0 Karma
1 Solution

niketn
Legend

@logloganathan you should explore the multisearch command which is not restricted by sub-search limitations

| multisearch 
    [search index=A sourcetype=B XXX=*]
    [search index=A sourcetype=B YYY=*]
    [search index=A sourcetype=B ZZZ=*]
| stats count by XXX YYY ZZZ

However, Splunk has numerous event grouping and correlation mechanisms based on the Use Cases and we can not always apply any one of the correlation mechanism for all the scenarios.

So you should elaborate on what exactly is your use case. If you are planning to pull 3 months of data to create an alert, could you rely on summary indexing instead? Community would be able to assist you better you add more context to your questions like what is your use case, what does your data look like? What have you tried so far and what does not seem to work?

I dont think a doctor should treat patient based on hunch rather the cure should be based upon symptoms!!! So for us to help you better add as much of details as possible to your questions 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@logloganathan you should explore the multisearch command which is not restricted by sub-search limitations

| multisearch 
    [search index=A sourcetype=B XXX=*]
    [search index=A sourcetype=B YYY=*]
    [search index=A sourcetype=B ZZZ=*]
| stats count by XXX YYY ZZZ

However, Splunk has numerous event grouping and correlation mechanisms based on the Use Cases and we can not always apply any one of the correlation mechanism for all the scenarios.

So you should elaborate on what exactly is your use case. If you are planning to pull 3 months of data to create an alert, could you rely on summary indexing instead? Community would be able to assist you better you add more context to your questions like what is your use case, what does your data look like? What have you tried so far and what does not seem to work?

I dont think a doctor should treat patient based on hunch rather the cure should be based upon symptoms!!! So for us to help you better add as much of details as possible to your questions 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

logloganathan
Motivator

I can provide only example use cases..i can't provide organization data..i already provided example query I just need output for that and i got it from you..thanks for that

0 Karma

niketn
Legend

I am glad you are able to resolve the issue that you are facing. Yes we understand that organization data can not be published on public forums, however, usually request here on Splunk Answers is for mocked/anonymized data. In fact most of the times if sensitive information is posted accidentally by folks, community moderators do reach out to them for masking/anonymizing the same.

Following is an example of anonymized data in similar format to how original event might have triggered in the system, but without revealing any sensitive information.

2017/01/12 08:09:04.325 AM [ERROR] Login failed for abc@def.com on server servername01@domain.com.

Having said that I am still curious on the use case for pulling 3 months data for an alert. It is up to you whether you want to post the use case or not since your issue is already resolved! 🙂

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

p_gurav
Champion

did you try usingappend command?

index=A sourectype=B "XXX" | stats count by XXX |append [search index=A sourectype=B "YYY" | stats count by YYY] | append [search index=A sourectype=B "ZZZ" | stats count by ZZZ]

logloganathan
Motivator

thanks..please post this in answer tab

0 Karma

kmaron
Motivator

Can you please provide more information.
What are you searching for? What are your searches? Is this a dashboard? What do you want to alert on?

0 Karma

logloganathan
Motivator

no its not dashboard i want to do search to find 3 data count..all are different.
is there any way to do that apart from dashboard?

0 Karma

p_gurav
Champion

Is your alert depend on output of 3 different searches? Can you share your searches and alert conditions ?

0 Karma

kmaron
Motivator

you need to provide more information
please give examples of the events you're searching and explain what counts you want

0 Karma

logloganathan
Motivator

yes..
index=A sourectype=B "XXX" | stats count by XXX
index=A sourectype=B "YYY" | stats count by YYY
index=A sourectype=B "ZZZ" | stats count by ZZZ

i want these three table in one page and alert configured for this

0 Karma

logloganathan
Motivator

any update?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...