Splunk Search

How to join two fields?

venkatesh296
Explorer

Hi All,
After doing some search, I got output as

x                                                                avg                 median
2017-01-11 12:16:00,[Process],D:\Program Files\local.Log         3                   5

The output I need should be like

 x                                                               avg                 median
2017-01-11 12:16:00,
[Process],
D:\Program Files\local.Log                                       3                   5

Thanks.

Here is the search:

index=abs (source=*log*)
| rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\" 
|eval seconds=(seconds/1000)
|eval seconds=coalesce(seconds,us)
| eval source=replace(source,"\d+\.log$",".log")
| table  _time sourceMETHOD seconds  
| bin  _time span=1m 
|eval _time=strftime(_time,"%Y-%m-%d %H:%M:%S")
|eval x=_time.",".METHOD.",".source
| stats  median(seconds) as median by x source METHOD 
| search METHOD="[Process]"
|eventstats  count as Linecount sum(median) as Total
|eval average=Total/Linecount
|fields x average median
Tags (2)
0 Karma

lguinn2
Legend

When you pasted your search into the comment, it lost some information. The rex commands don't make any sense now - but I have copied them here. This should work

 index=abs source=*log*
 | rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\"
 | search METHOD="[Process]"
 | eval seconds=(seconds/1000)
 | eval seconds=coalesce(seconds,us)
 | eval source=replace(source,"\d+\.log$",".log")
 | bin span=1m _time
 | eval x = strftime(_time,"%x %X") . "\n" . METHOD . "\n" . source
 | stats median(seconds) as median by x 
 | eventstats count as Linecount sum(median) as Total
 | eval average=Total/Linecount
 | fields x average median

Although it seems to me that METHOD is not really needed at all, since you have filtered to show only the Process method. And I am a bit uncomfortable with the calculation of average: in the eventstats command, as count will be only a count of the number of stats results, not the count of events returned by the search. I did a couple of things to make the search more efficient.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What is the difference in these two outputs? single line vs multiline?? If that is the case, try this

your current search giving fields x, average, median | makemv x delim=","
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@venkatesh296 - Can you provide the search that you used? That would be helpful for users attempting to assist you in how you got your initial output and how you want your output to look like.

In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible. Thanks.

0 Karma

venkatesh296
Explorer
index=abs (source=*log*)   | rex "(?i)log\s(?\[\w+.\w+])" | rex "in\s+(?P\d+)\s+\ms" | rex "in\s(?\d+.\d+)\" |eval seconds=(seconds/1000)|eval seconds=coalesce(seconds,us)| eval source=replace(source,"\d+\.log$",".log")| table  _time sourceMETHOD seconds  | bin  _time span=1m |eval _time=strftime(_time,"%Y-%m-%d %H:%M:%S")|eval x=_time.",".METHOD.",".source| stats  median(seconds) as median by x source METHOD | search METHOD="[Process]"|eventstats  count as Linecount sum(median) as Total|eval average=Total/Linecount|fields x average median
0 Karma

aaraneta_splunk
Splunk Employee
Splunk Employee

@venkatesh296 - Did one of the answers below help provide a solution your question? If yes, please click “Accept” below the best answer to resolve this post and upvote anything that was helpful. If no, please leave a comment with more feedback. Thanks.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...