I have the following Splunk search query that is working fine:
sourcetype="x"
"ABC" NOT D|
lookup rr_by_dd dd as dd OUTPUT rr as rr
|stats DC(MAC) as Unique_Number_O by rr
|append
[ search
sourcetype="x"
"ABC" AND D|
lookup rr_by_dd dd as dd OUTPUT rr as rr
|stats DC(MAC) as Unique_Number_T by rr]
|append
[ search
sourcetype="x"
"ABC"|
lookup rr_by_dd dd as dd OUTPUT rr as rr
|stats DC(MAC) as Unique_Number_B by rr]
I get the following Result set:
rr Unique_Number_O
house 120
APT 90
rr Unique_Number_T
house 100
APT 60
rr Unique_Number_B
house 80
APT 30
I would like to get the result set as follow:
rr Unique_Number_O Unique_Number_T Unique_Number_B
house 120 100 80
APT 90 60 30
I have been not able to get the query to obtain the result set sorted out as I want.
Any ideas will be appreciated.
Thanks,
Lp
But now I have the issue of subsearch limits. This is a Karma ;-).
by replacing append to appendcols solved my issue.
Thanks,
Lp