Splunk Search

Search String but retain values

tb5821
Communicator

new to splunk so go easy on me

I can currently run two different searches and get the the results I'm looking for but the problem is that its two different searches 🙂

The only field which they have in common is task_id how can I run both of these searches together still get the lines with the strings I'm interested in? Also within each search I'm renaming some of my fields ie ... | rename tt AS "Encode Time" and my other search is ... | rename tt AS "Copy Time"

Tags (1)
0 Karma
1 Solution

Damien_Dallimor
Ultra Champion

Try the transaction search command to stitch events together based on the common field :

... | transaction task_id

Not sure about the field renaming without seeing more concise examples of the events.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

try this:

(sourcetype=A "encode") OR (sourcetype=B copying) | eval encode_time=if(searchmatch("encode"),tt,null()) | eval copy_time=if(searchmatch("copying"),tt,null())

Also, depending what you're doing the ... | stats ... by task_id command may be better than transaction task_id

0 Karma

tb582
Explorer

does it matter that my source types are both the same?

0 Karma

Damien_Dallimor
Ultra Champion

Try the transaction search command to stitch events together based on the common field :

... | transaction task_id

Not sure about the field renaming without seeing more concise examples of the events.

Damien_Dallimor
Ultra Champion

You can setup Splunk "event types" for your different tasks.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Abouteventtypes

0 Karma

tb582
Explorer

Unfortuantly I don't think its that easy I've tried all sorts of things join, set, append but just either not doing it in the right order or not doing it right at all. Here's an example of the two queries.

index=myindex sourcetype=app host=1* OR host=050 "SUCCESS : 100% : Encode completed" | rename Task_time as "Encode Time"

search index=myindex sourcetype=app host=1* OR host=050 "SUCCESS : 100% : Push Completed" | rename Task_time as "Transfer Time"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...