Splunk Search

Combine 3 queries into tabular form for export to .csv

shrogers
Loves-to-Learn Everything

Hi All,

Need some assistance combining 3 queries in tabular form so I can export them to a lookup table.
I'm also trying to add a date range
Example - On 2021-02-18 morning we report metrics from  2021-02-16 5:00 PM to 2021-02-17 5:00 PM

Q1:
index=tst1 sourcetype IN (tst2, tst4, tst5) source IN ("/opt/performance.log", "/opt/formance.log", "/opt/test.log") | fields TRAN_TYPE, respTime, TRAN_TIME_MS |stats count as Total, count(eval(TRAN_TIME_MS<=3000)) as Total_Under_3sec1 ,count(eval(respTime<=3000)) as Total_Under_3sec2 | addtotals fieldname="Total_Under_3sec" Total_Under_3sec1 Total_Under_3sec2 | eval Perc = (Total_Under_3sec / Total)*100 |fields Perc

Q2:
index=tst2 sourcetype=tst2 PAGE_ID_WEIGHT=* TRAN_TYPE =* PAGE_ID=345 ACTION=GET | eval USER_ID=lower(USER_ID) | stats dc(USER_ID)

Q3:
index=tst3 sourcetype=test3 method=POST login=/tst3* user!=unauthenticated msgCode=302 | eval action=case(status==302,"Success") | stats dc(user)

Col1    Col2      Col3
99        89         97

Any assistance is appreciated.

Labels (1)
0 Karma

saravanan90
Contributor

Great !!

Appreciate if you could accept as solution....:)

0 Karma

saravanan90
Contributor

This may help...

Query 1 | appendcols [ search Query2] | appendcols [search query3]

e.g:  index=_internal | stats count as col1 | appendcols [search index=_introspection | stats count as col2] | appendcols [search index=_audit | stats count as col3]

0 Karma

shrogers
Loves-to-Learn Everything

Thank you for your quick response.

It works as expected.

0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...