Splunk Search

How to use results of stats command in other stats commands?

bollam
Path Finder

Hello,

I need some assistance on the following scenario.

Let's say I have a fields "Country" "cities" "command"

These are few events:

These are few cities of India.
Country=India, cities="Hyderabad, Bangalore, Kerala" command="common"

Country=Srilanka cities="Kandy, Colombo, Galle"

Country=Australia cities="Melbourne, sydney, Adelaide" command="common"

Country=USA cities="California, Cupertino, NewJersey"

Country=UK cities="Manchester, Headingley, Edgbaston" command="common"

Country=china cities="Beijing, Shanghai, Tianhe, common"

I have a sample query which gives me the result of source

index=sai_core sourcetype="city_log" command="common"
| makemv delim="," cities
| stats values(cities) as cities by source

I want to make use of these results of source to use as a group by for another search.

 index=sai_core sourcetype="city_log"
| makemv delim="," cities
| stats values(cities) as cities by source

How do I do this?

Tags (1)
0 Karma

macadminrohit
Contributor

Not sure if i could understand what your exact requirement is . Can you explain what you need exactly, the first search is pretty straight forward and you have already built it, show me the desired out after the second search . I tried to mimick using the dummy data, you could use the output to another search by using join or append

| makeresults 
| eval DATA="Country;India cities;Hyderabad,Bangalore,Kerala command;common:Country;Srilanka cities;Kandy,Colombo,Galle:Country;Australia cities;Melbourne,sydney,Adelaide command;common:Country;USA cities;California,Cupertino,NewJersey:Country;UK cities;Manchester,Headingley,Edgbaston command;common:Country;china cities;Beijing,Shanghai,Tianhe" 
| makemv DATA delim=":" 
| mvexpand DATA 
| makemv DATA delim=" " 
| eval Country=mvindex(DATA,0) 
| eval Cities=mvindex(DATA,1) 
| eval Command=mvindex(DATA,2) 
| fields Cities Command Country _time 
| rex field=Cities "cities\;(?P<Cities>.*)" 
| makemv Cities delim="," 
| mvexpand Cities 
| rex field=Command "command\;(?P<Command>.*)"  
| rex field=Country "Country\;(?P<Country>.*)" | stats values(Cities) as Cities by Country | mvexpand Cities
0 Karma

niketn
Legend

@bollam seems like a use case for Post Processing. However, you would need to create the same depending on what is your another search. So please refer the documentation with examples. Also ensure that you understand Post Processing Best practices.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...