×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
Bettynet
Engager
Member since: ‎06-17-2021
‎06-17-2021
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎06-17-2021
Activity Feed
View All

Re: result of two searches in one variable

by in Splunk Search
‎06-17-2021 06:47 AM
‎06-17-2021 06:47 AM
Yes! that did work!!!   Thank you both very much!!! @kamlesh_vaghela @richgalloway    Really grateful ^^ ... View more

Re: result of two searches in one variable

by in Splunk Search
‎06-17-2021 06:42 AM
‎06-17-2021 06:42 AM
Dear @richgalloway,    Thanks for your quick response. As you said, yes I tried with appendcols with no results. I also tried including the index name, but got the error: "Unknown search command 'index'".    Could you please explain how should it be??   index="opex_mobile_index" | eventstats max(source) as last_source | where match(source,last_source) | table "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Total" | dedup "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Total" | stats sum("ImporteSolicitado_EUR_Partida_Total") as total_budget | appendcols [index="opex_mobile_index" | eventstats max(source) as last_source | where match(source,last_source) | search "Descripcion_Partida_Detalle"="Entregado QFC2" | table "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Detalle" | dedup "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Detalle" | stats sum("ImporteSolicitado_EUR_Partida_Detalle") as QFC2_budget] | eval diferencia = total_budget - QFC2_budget   Thanks again! ... View more

result of two searches in one variable

by in Splunk Search
‎06-17-2021 03:14 AM
‎06-17-2021 03:14 AM
Hi, I would like to have a dashboard panel with just a number, which should be the substraction of two values obtained from two searches. Both searches work individually, but I can't find the way to put them together in one search.    Search 1: index="opex_mobile_index" | eventstats max(source) as last_source   | where match(source,last_source) | table "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Total" | dedup "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Total" | stats sum("ImporteSolicitado_EUR_Partida_Total") as total_budget    Search 2: index="opex_mobile_index" | eventstats max(source) as last_source   | where match(source,last_source) search "Descripcion_Partida_Detalle"="Entregado QFC2" | table "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Detalle" | dedup "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Detalle" | stats sum("ImporteSolicitado_EUR_Partida_Detalle") as QFC2_budget   Combination: index="opex_mobile_index" | eventstats max(source) as last_source   | where match(source,last_source) | table "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Total" | dedup "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Total" | stats sum("ImporteSolicitado_EUR_Partida_Total") as total_budget  | append [search "Descripcion_Partida_Detalle"="Entregado QFC2" | table "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Detalle" | dedup "CECO", "Descripcion_Partida_Total", "Partida", "ImporteSolicitado_EUR_Partida_Detalle" | stats sum("ImporteSolicitado_EUR_Partida_Detalle") as QFC2_budget] | eval diferencia = total_budget - QFC2_budget   This does not work. Nothing is output from the append [ ]. I used append, appendpipe, appendcols, multisearch... I don't know what I am doing wrong.    Any help would be highly appreciated.    Thanks!  ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎06-17-2021 10:30 AM