Splunk Search

How to edit my search to combine 4 columns into one total column?

JoshuaJohn
Contributor

Hi

I'm new to the community and to Splunk. I am trying to combine the 4 columns my search creates into one total column or one column that is separated by the 4 search terms (it's one column with different colors for the different search terms) . This is my search term below: (This creates 4 columns: CREATED, LINKED, Session_Cancelled, and Session_Failed)

index=company_myapp REQUEST_URL:*payment/myapp* AND (REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND (CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  | rex "CURRENT_STATUS:(?.*)" |stats count by status_name

I tried this, but Splunk said index is not a search term.

index=company_myapp REQUEST_URL:*payment/myapp* AND (REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND (CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  | rex "CURRENT_STATUS:(?.*)" |stats count by status_name | append [index=company_myapp REQUEST_URL:*payment/myapp* | stats count by URL]

Any suggestions, ideas?

0 Karma

sundareshr
Legend

See if this gives you what you are looking for

index=company_myapp REQUEST_URL:*payment/myapp* AND (REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND (CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  | rex "CURRENT_STATUS:(?.*)" | stats latest(status_name) as status by url
0 Karma

JoshuaJohn
Contributor

This returned "no data"

0 Karma

sundareshr
Legend

Does your data have status_name and url fields extracted? If no, those need to be extracted using rex or some other method.

0 Karma

Raschko
Communicator

Subsearches have to start with the command search. So this should work:

     index=company_myapp REQUEST_URL:*payment/myapp* AND 
(REQUEST_METHOD:PUT OR REQUEST_METHOD:POST) AND 
(CURRENT_STATUS:CREATED OR CURRENT_STATUS:LINKED OR CURRENT_STATUS:SESSION_*)  
    | rex "CURRENT_STATUS:(?<status_name>.*)" 
    | stats count by status_name 
    | append [search index=company_myapp REQUEST_URL:*payment/myapp* | stats count by URL]

Edit:
Your rex command is wrong in this. Sorry no testing ground at the moment.
Not sure about the field name status_name.

If all fails, do you have some example events (sanitized) to show?

0 Karma

JoshuaJohn
Contributor

This returned the original graph to me

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...