×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
jjohn149
Observer
Member since: ‎08-06-2024
‎08-07-2024
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎08-06-2024
Activity Feed
View All

Re: Combining 3 queries output to produce table

by in Splunk Search
‎08-07-2024 12:26 PM
‎08-07-2024 12:26 PM
Also, when I enter: | eval start_date=relative_time(now(), "-90d@d") | eval end_date=now() | where DATE >= start_date AND DATE <= end_date below the stats count command line at the end, the query does not filter my data  ... View more

Re: Combining 3 queries output to produce table

by in Splunk Search
‎08-07-2024 12:22 PM
‎08-07-2024 12:22 PM
Hey, Maybe this is a better example. |union index=osp source=xxx EVENT_TYPE=xxx EVENT_SUBTYPE=xxx | search PLNF=* REN=INT OKELS="" | eval DATE = strftime(strptime(BADAT, "%Y%m%d"), "%Y-%m-%d") | stats count as example1 by FNHB FNPO DATE | eval SourceType="example 1" [ search index=osp source=xxx EVENT_TYPE=xxx EVENT_SUBTYPE=xxx PLNF=* REN=INT HTSZ=R OKELS="" EHUH=FIERY | eval DATE = strftime(strptime(BADAT, "%Y%m%d"), "%Y-%m-%d") | stats count as example2 by FNHB FNPO DATE | eval SourceType="example 2" ] [ search index=osp source=xxx EVENT_TYPE=xxx EVENT_SUBTYPE=xxx PLNF=* REN=INT HTSZ=R OKELS="" NOT EHUH=FIERY | eval DATE = strftime(strptime(BADAT, "%Y%m%d"), "%Y-%m-%d") | stats count as example3 by FNHB FNPO DATE | eval SourceType="example 3" ] | stats count(example1) as "example 1" count(example2) as "example 2" count(example3) as "example 3" by DATE I didn't quite understand how you were filtering the search fields on that second line   ... View more

Combining 3 queries output to produce table

by in Splunk Search
‎08-06-2024 06:08 PM
‎08-06-2024 06:08 PM
|union [ search index=osp source=xxx EVENT_TYPE=xxx EVENT_SUBTYPE=xxx field1=* field3=xxx field4="" | eval DATE = strftime(strptime(xxx, "%Y%m%d"), "%Y-%m-%d") | stats latest(source) as example1 by field5 field6 DATE] [ search index=osp source=xxx EVENT_TYPE=xxx EVENT_SUBTYPE=xxx field1=* field3=xxx field3=xxx field4="" | eval DATE = strftime(strptime(xxx, "%Y%m%d"), "%Y-%m-%d") | stats latest(source) as example2 by field5 field6 DATE] [ search index=osp source=xxx EVENT_TYPE=xxx EVENT_SUBTYPE=xxx field1=* field3=xxx NOT field3=xxx field4="" | eval DATE = strftime(strptime(xxx, "%Y%m%d"), "%Y-%m-%d") | stats latest(source) as example3 by field5 field6 DATE] | stats count(example1) as "example 1", count(example2) as "example 2", count(example3) as "example 3" by DATE The data is populating correctly for example 1 and example 3, individually, and if I just use two queries. However, I need all 3 queries for my data but data is missing from example 2. ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎08-07-2024 04:13 PM