Hi renjith, I found the partial solution for my problem. index=A ("StringA" OR "StringB") |stats count(eval(searchmatch("StringA"))) as CountA ,count(eval(searchmatch("StringB"))) as CountB by commonID with this i am able to achieve the data in below format. Common ID Count A Count B I am not getting Difference as another column, can you please tell how to get the difference as a separate column in results. ... View more

Hi Renjith, it is not working, i have updated my question. index=A Search String A| rex field=_raw command=(?CommonID\w+) | stats count as CountA by CommonID index=A Search String B | rex field=_raw command=(? CommonID\w+) | stats count as CountB by CommonID Common ID i am getting through rex command. I am looking for the below output in columns format. Common ID Count A Count B Difference ( i.e. Count A - Count B) Kindly suggest on this any approach, i have tried subsearch and joins. Unable to get the result. ... View more

Hi team, I have corrected the statements for everyone understanding. Hi team, I have two below queries, can you please suggest how to merge and get difference of counts in separate column. index=A Search String A| rex field=_raw command=(?Common ID\w+) | stats count as CountA by CommonID index=A search string B | rex field=_raw command=(? Common ID\w+) | stats count as CountB by CommonID Common ID i am getting through rex command. I am looking for the below output in columns format. Common ID Count A Count B Difference ( i.e. Count A - Count B) Kindly suggest on this any approach, i have tried subsearch and joins. Unable to get the result. ... View more

Hi Woodcock, Arjun helped regarding this query, it is working fine. I am looking for another solution. Which i will raise as a separate request. ... View more

Hi Arjun, Thank you for your patience for answering my questions. I have two below queries, can you please suggest how to merge and get difference of counts in separate column. index=A | rex field=_raw command=(?\w+) | stats count by CountA index=A | rex field=_raw command=(?\w+) | stats count by CountB Common ID i am getting through rex command. I am looking for the below output, Common ID Count A Count B Difference ( i.e. Count A - Count B) Kindly suggest on this any approach, i have tried subsearch and joins. Unable to get the result. ... View more

Hi Arjun, POST is not available in both events, it is available in start event only. I can't add this to base search. ... View more

Hi Arjun, I did this , but i am getting null values of start and end of trace also including in this count, which i am looking to include both start and end not null case count. ... View more

Hi Arjun, Can you provide how to calculate count for the same criteria, which either start or end is not null ( i.e. Start and end consider as one event). If you can provide the query for this it will be very helpful. ... View more

Hi Arjun, Thanks for quick reply, i am able to convert the timestamp. The below event log is my sample raw data. if i give "security gate check" i am able to see the start time , if i give " Security gate check POST" it is not working. I am giving post because some other requests has PATCH to avoid that event logs. "2019-12-05 08:03:25.348 INFO [price:promotion:rrt-0c8dfd466053d7c3c-b-de-18025-17252943-6,4c5c49909b36f6f3,4c5c49909b36f6f3] 23 xxxxx : Security gate check : requestURI : /promotions/async : HttpMethod : POST ... View more

hi Arjun, Thanks for quick reply. Even the events available in the selected time range ( i.e 7 days), I am getting as a null for start time. For end time i am able to see end time in Unix timestamp format. How to get the actual timestamp instead of unix epoch format. Kindly suggest on the same. ... View more

Hi Arjun, I am unable to receive with this query start time. Can you explain the query for understanding my requirement. ... View more

Hi Woodcock, Thanks for your reply. Both log events are from same request only, one is related to one layer and second one is related to another layer of same request. We are trying to find the each layer wise response time. in both statements only one common trace id is only available. the given query is not resulting any results. Kindly provide alternative solution for my requirement. ... View more

Hi team, I am looking for in the given splunk query, if start event is available and end event is not avaialble it should not pick the wrong event as a end event. In such cases it should not consider it as a successful transaction, i would like to showcase it as a failed transaction or incomplete transaction. How can we achieve the expected result, kindly suggest on the same. ... View more

Hi Mathias Lindblom, thanks for the update. ... View more