Splunk Search

Stats Values Multisearch

IRHM73
Motivator

Hi, I wonder whether someone could help me please.

I'm using the following join query which extracts the data perfectly:

`wso2_wmf(RequestCompleted)`
request.detail.Context="individual-*" OR 
request.detail.Context="marriage" OR 
request.detail.Context="national"
| rename request.detail.applicationClientId as clientId request.detail.Context as api
| join clientId [ | search `application_wmf(RequestReceived)` detail.input="Request to /application"
| spath output=developer input=detail.responseMessage path=name 
| rex field=tags.transactionName "clientId\=(?<clientId>[^\W]+)"]
| stats count by developer api

The problem I have is that I no that the Join command is inefficient and my results will be restricted to 50,000 rows.

I know that the best alternative is to use the 'Stats Values' but after trying this using a multisearch and then as OR statement solution as shown below, I have difficulty in bringing together the developer name when using the stats count by api.

(`wso2_wmf(RequestCompleted)`)
    request.detail.Context="individual-*" OR 
    request.detail.Context="marriage" OR 
    request.detail.Context="national")
( `application_wmf(RequestReceived)`)

Could someone have a look at this please and let me know where I've gone wrong?

Many thanks and kind regards

Chris

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...