Splunk Search

Combining two searches for purpose of table & stats

Barty
Explorer

Good afternoon all,

Apologies for the below, my first question and also I'm a complete newbie to this. So, I have been asked by a user if it would be possible to combine two searches for the purpose of creating a table that has the resulting fields and also a stats count on one of the fields.

Let me explain. The two base searches are:-

Search 1:

index=our_index "Initialising journeyContext using initial request parameters:[AggregatorInitialRequest{aggregatorID" source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log"
| rex "\[[^\:]*\:(?<sessionId>.*)\:\:\:M6.*aggregatorID\=\'(?<aggId>[^\']*)"
| table sessionId aggId

Search 2

index=our_index source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log" 
| rex "\[[^\:]*\:(?<sessionId>[^\:]*)\:(?<requestId>[^\:]*)" 
| dedup requestId 
| stats count as counter by sessionId

What the end user would like is a table that has sessionId | aggId | count

Now I have played around trying to use the join command on sessionId, but to no avail and it's absolutely killing me. I've got as far as trying this, but no results are returning:-

index=our_index "Initialising journeyContext using initial request parameters:[AggregatorInitialRequest{aggregatorID" source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log"
| rex "\[[^\:]*\:(?<sessionId>.*)\:\:\:M6.*aggregatorID\=\'(?<aggId>[^\']*)"
| join sessionId 
    [search index=app_qnb earliest=-10m source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log" | rex "\[[^\:]*\:(?<sessionId>[^\:]*)\:(?<requestId>[^\:]*)"]
| table sessionId

I was hoping i could at leats get as far as the combination of both sessionId results, but no such luck. I'm turning to you guys as I know someone out there is going to hopefully show how to do this quickly, easily and far less complicated than I am making it! Oh, and it's v6.6.4 if that helps.

Help me Obi-splunk_kenobi, you're my only hope

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try..

 index=our_index source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log"
| rex "\[[^\:]*\:(?<sessionId>[^\:]*)"
| rex "\[[^\:]*\:(.*)\:\:\:M6.*aggregatorID\=\'(?<aggId>[^\']*)"
| rex "\[[^\:]*\:([^\:]*)\:(?<requestId>[^\:]*)" 
| stats values(aggId) as aggId dc(requestId) as counter by sessionId

View solution in original post

0 Karma

Barty
Explorer

Seems to have worked a charm! Thank you

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try..

 index=our_index source="/user_projects/domains/gidprd/servers/qbp-*/logs/qnb-application-log/car-qnb-application.M6.log"
| rex "\[[^\:]*\:(?<sessionId>[^\:]*)"
| rex "\[[^\:]*\:(.*)\:\:\:M6.*aggregatorID\=\'(?<aggId>[^\']*)"
| rex "\[[^\:]*\:([^\:]*)\:(?<requestId>[^\:]*)" 
| stats values(aggId) as aggId dc(requestId) as counter by sessionId
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...