Splunk Search

How to combine my three searches into one search?

manhuang
Explorer

Hi all,

I want to combine the three searches below into one to display all data in the result. However, it should not have poor performance and can be expanded in the future.

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40

index=application sourcetype=aEvent  splunk_server_group=ewea  host=*  level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8

Would you give some suggestions?

Tags (3)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this. For any new set of eventName values, just add them to base search for filter and app in the case statement for filter based on count.

index=application sourcetype=aEvent  splunk_server_group=ewea host=*  level=error 
(eventName=A_ERROR OR eventName=B_EVENT) OR (eventName=C_EVENT OR eventName=D_EVENT) OR (eventName=E_EVENT OR eventName=F_EVENT) 
| stats count by eventName  
| eval ShouldInclude=case((eventName="A_ERROR" OR eventName="B_EVENT") AND count>40,"YES",(eventName="C_EVENT" OR eventName="D_EVENT") AND count>2,"YES",(eventName="E_EVENT" OR eventName="F_EVENT") AND count>8,"YES",1=1,"NO") 
| where ShouldInclude="YES" | fields - ShouldInclude
0 Karma

chimell
Motivator

hi
try this search code with set command

|set union [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40|fields eventName  count ][|set union [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2|fields eventName count][search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8|fields eventName count]]
0 Karma

ngatchasandra
Builder

Hi manhuang,

Try this

index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=A_ERROR OR eventName=B_EVENT) | stats count by eventName|where count>40
|appendcols [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=C_EVENT OR eventName=D_EVENT) | stats count by eventName|where count>2]
|appendcols [search index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error (eventName=E_EVENT OR eventName=F_EVENT) | stats count by eventName|where count >8]
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try

index=application sourcetype=aEvent splunk_server_group=ewea host=* level=error eventName=* 
|stats count(eval(eventName="A_ERROR" OR eventName="B_EVENT")) as AB_EVENT_COUNT,count(eval(eventName="C_EVENT" OR eventName="D_EVENT")) as CD_EVENT_COUNT,count(eval(eventName="E_EVENT" OR eventName="F_EVENT")) as ER_EVENT_COUNT
Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...