Splunk Search

How to merge two Splunk queries ?

nilbak88
Explorer

Hi All,

I need help with  Splunk Query for below scenario:

Query 1:
index =abc | table src, dest_name, severity, action

If it finds dest_name for any high and critical severity, it will look for computerdnsname in index xyz and there if it matches, it will display the result

Query 2:

index=xyz 

 

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @nilbak88,

as @richgalloway said it's difficoult to help you with these few informations, so anyway I try to suppose your need:

Query 1:
(index =abc (severity=high OR severity=critical)) OR index=xyz 
| eval dest_name=coalesce(dest_name,computerdnsname)
| stats values(src) AS src values(severity) AS severity values(action) AS action dc(index) AS dc_index BY dest_name
| where dc_index=2
| table dest_name src severity action

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @nilbak88,

as @richgalloway said it's difficoult to help you with these few informations, so anyway I try to suppose your need:

Query 1:
(index =abc (severity=high OR severity=critical)) OR index=xyz 
| eval dest_name=coalesce(dest_name,computerdnsname)
| stats values(src) AS src values(severity) AS severity values(action) AS action dc(index) AS dc_index BY dest_name
| where dc_index=2
| table dest_name src severity action

Ciao.

Giuseppe

nilbak88
Explorer

thanks @gcusello . 
That's what i was looking for.
However, i will get back to you on this again if needed more help

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nilbak88,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How to merge the queries depends on what results you want displayed.  Please tell us more about that.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...