Splunk Search

multiple sourcetype search and scoring

DonDandrea
Path Finder

I have been working on a search for a while and I am stumped.

I am searching two different source types. One value I am extracting is a stats count and the other is the sum of values from the other source type. I need to combine the results from the two based on a single field. The field exists in both source types but each has it's own name. If I do not rename it one of the two values is present. If I rename it then the other shows. I really need to get both of these values in and be able to run an eval on them to determine percentage to understand who is having the most problems using our software. The two fields that match are Agency and Agent.

index=dspro (sourcetype=telemetry(Version=PROD OR Version=BETA OR Version=ALPH)) OR (sourcetype=bootlogmaster (DSproSystem=Prod OR DSproSystem=Beta OR DSproSystem=Alph)) | rename Agent as Agency | stats sum(TotalTransactions) as transaction_count count(eval(sourcetype="bootlogmaster")) as error_count by Agency | eval percent=(error_count/transaction_count)*100 | sort by Agency
Tags (1)
0 Karma
1 Solution

lguinn2
Legend

I would have expected the rename to work properly, but since it apparently didn't, try coalesce instead:

index=dspro (sourcetype=telemetry (Version=PROD OR Version=BETA OR Version=ALPH)) OR (sourcetype=bootlogmaster (DSproSystem=Prod OR DSproSystem=Beta OR DSproSystem=Alph)) 
| eval Agency=coalesce(Agency,Agent)
| stats sum(TotalTransactions) as transaction_count 
        count(eval(sourcetype="bootlogmaster")) as error_count by Agency 
| eval percent=(error_count/transaction_count)*100 
| sort by Agency

(BTW, it is entirely okay for a search to span multiple lines, just copy and paste this into the search box.)

View solution in original post

lguinn2
Legend

I would have expected the rename to work properly, but since it apparently didn't, try coalesce instead:

index=dspro (sourcetype=telemetry (Version=PROD OR Version=BETA OR Version=ALPH)) OR (sourcetype=bootlogmaster (DSproSystem=Prod OR DSproSystem=Beta OR DSproSystem=Alph)) 
| eval Agency=coalesce(Agency,Agent)
| stats sum(TotalTransactions) as transaction_count 
        count(eval(sourcetype="bootlogmaster")) as error_count by Agency 
| eval percent=(error_count/transaction_count)*100 
| sort by Agency

(BTW, it is entirely okay for a search to span multiple lines, just copy and paste this into the search box.)

DonDandrea
Path Finder

I would have never found this solution on my own since it is not in Splunk's List of search commands. I did a search and found documentation though. Thank you very much. I have been pulling my hair out trying to figure this out.

0 Karma

DonDandrea
Path Finder

dded the space and came up with the same result.
index=dspro (sourcetype=telemetry (Version=PROD OR Version=BETA OR Version=ALPH)) OR (sourcetype=bootlogmaster (DSproSystem=Prod OR DSproSystem=Beta OR DSproSystem=Alph)) | rename Agent as Agency | stats sum(TotalTransactions) as transaction_count count(eval(sourcetype="bootlogmaster")) as error_count by Agency | eval percent=(error_count/transaction_count)*100 | sort by Agency

0 Karma

grijhwani
Motivator

Edited to format the search. Incidentally you appear to be missing a space after "telemetry".

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...