Splunk Search

Join multiple search queries to get the consolidated result

kodali2105
Engager

Hi,
I have the below search queries and I want to combine these two queries in to one query.

query 1:
cbs2_req_res.log OR Complete with HTTP Response code | rex "(?i).*?\->(?P\w+)(?=:)" | rex "Complete with HTTP Response code : (?\d+)" | timechart span=1d count(http_response_code)

query 2:
cbs2_req_res.log OR Finished execution of method | rex "(?i).*?\->(?P\w+)(?=:)" | timechart span=1d count

Can you some one please help me to get the combined query?

Tags (1)

woodcock
Esteemed Legend

I agree with sideview: your base search is definitely wrong and I think his first suggestion is what you intended. Additionally, all of your 'rex' commands are broken (or unused). Also, I suspect your "count" command is not doing what you would like it to do. Finally, I am unclear on your end goal ("how" you would like to join them). If you would simply like multiple lines to chart on the same graph, maybe this is what you are trying to do:


source=cbs2_req_res.log ("Finished execution of method" OR "Complete with HTTP Response code") | rex "Complete with HTTP Response code : (?\\d+)" | timechart span=1d count(isnotnull(http_response_code)) AS httpCount, count AS allCount | eval finishedExecutionCount = allCount - httpCount

This gives you 3 sets of (related) data and 3 lines to chart.

P.S. I know part of the problem is markdown mucking up what you typed (which is also why the "d+" in the code example of my answer above is missing the backslash; I could not figure out how to get it to format correctly with markdown)

sideview
SplunkTrust
SplunkTrust

What you're doing with the OR's looks a little strange. What these are telling Splunk is (cbs2_req_res.log OR Complete) with HTTP Response code. Meaning find events that have either "cbs2_req_res.log" or the word "Complete" in them, and that also have the words "with", "HTTP", "Response" and "code" in them.

Can you confirm or edit your searches to fix?

For example you might be intending to search for

cbs2_req_res.log OR "Complete with HTTP Response code"

or maybe you intended something like::

(cbs2_req_res.log OR Complete) "with HTTP Response code"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...