Splunk Search

club 3 search queries into 1

BMUDGAL1190
New Member

I have given the query below. I am trying to display all 3 RERs- RERa, RERb, RERc. But this is displaying just RERb and RERc. RERa is not getting displayed. Is there any limitation on appendcols iteration? Or if anyone has some suggestion how I can accomplish what I need.

index=cba_mainframe AND MSGTXT = "*RC=0000*" AND JOBNAME=P6435COY OR JOBNAME=P6435CON|stats count AS total 
|appendcols [search 
|head 1
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m") 
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RERa=case(Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time2 AND Time1 < Time3),"100", 
               Week_DAY=3 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"0", 
               Week_DAY=4 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0"
                                              )]
|stats values(RERa) as RER1
|appendcols [search index=cba_mainframe AND MSGTXT = "*RC=0000*" AND JOBNAME=P6435SEF OR JOBNAME=P6435SEE
|head 1
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m") 
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RERb=case(Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time6 AND Time1 < Time7),"100", 
               Week_DAY=3 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"0",
               Week_DAY=4 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0"
                                              )
]|stats values(RERb) AS RER2
|appendcols
[search index=cba_mainframe AND MSGTXT = "*RC=0000*" AND JOBNAME=P6435GEF OR JOBNAME=P6435GEE
|head 1
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m") 
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RERc=case(Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time8 AND Time1 < Time9),"100", 
               Week_DAY=3 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"0",
               Week_DAY=4 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0"
                                              )
]
|table RER2 RERc RER1 
|eval RER=(RERc+RER2+RER1)/3
Tags (3)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=cba_mainframe MSGTXT="*RC=0000*"  (JOBNAME="P6435COY" OR JOBNAME="P6435CON") OR (JOBNAME="P6435SEF" OR JOBNAME="P6435SEE") OR (JOBNAME="P6435GEF" OR JOBNAME="P6435GEE")
| eval dedupField=case(JOBNAME="P6435COY" OR JOBNAME="P6435CON", "type1",JOBNAME="P6435SEF" OR JOBNAME="P6435SEE", "type2" , true(), "type3" )
| dedup dedupField
|eval Current_DY = strftime(now(),"%a")
|eval Time1=relative_time(now(),"-0s")
|eval Time2=relative_time(now(),"@d+1s")
|eval Time3=relative_time(now(),"@d+8h")
|eval Time4=relative_time(now(),"@d+22h")
|eval Time5=relative_time(now(),"@d+1439m")
|eval Time6=relative_time(now(),"@d+20h")
|eval Time7=relative_time(now(),"@d+1410m")
|eval Time8=relative_time(now(),"@d+1230m") 
|eval Time9=relative_time(now(),"@d+21h")
|eval Week_DAY=case(Current_DY="Mon",1,Current_DY="Tue" OR Current_DY="Wed" OR Current_DY="Thu" OR Current_DY="Fri",2,Current_DY="Sat",3,Current_DY="Sun",4)
|eval RER1=case(dedupField!="type1", null(), Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time2 AND Time1 < Time3),"100", 
               Week_DAY=3 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time5),"0", 
               Week_DAY=4 AND JOBNAME="P6435COY" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435CON" AND MSGTXT LIKE "%RC=0000%","0" )
|eval RER2=case(dedupField!="type2", null(), Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time6 AND Time1 < Time7),"100", 
               Week_DAY=3 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time6) OR (Time1 > Time7 AND Time1 < Time5),"0",
               Week_DAY=4 AND JOBNAME="P6435SEF" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435SEE" AND MSGTXT LIKE "%RC=0000%","0" )
|eval RERc=case(dedupField!="type3", null(), Week_DAY=1 AND (Time1 >= Time4 AND Time1 < Time5),"100",
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" ,"100", 
               Week_DAY=1 AND (Time1 > Time2 AND Time1 < Time4) AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0",
               Week_DAY=2 AND (Time1 >= Time2 AND Time1 < Time3)  OR (Time1 > Time4 AND Time1 < Time5),"100", 
               Week_DAY=2 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"100", 
                                              Week_DAY=2 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time3 AND Time1 < Time4),"0", 
                                              Week_DAY=3 AND (Time1 >= Time8 AND Time1 < Time9),"100", 
               Week_DAY=3 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"100", 
                                              Week_DAY=3 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%" AND (Time1 > Time2 AND Time1 < Time8) OR (Time1 > Time9 AND Time1 < Time5),"0",
               Week_DAY=4 AND JOBNAME="P6435GEF" AND MSGTXT LIKE "%RC=0000%","100", 
                                              Week_DAY=4 AND JOBNAME="P6435GEE" AND MSGTXT LIKE "%RC=0000%","0" )
| stats values(RER1) as RER1 values(RER2) as RER2 values(RERc) as RERc
|eval RER=(RERc+RER2+RER1)/3
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Why append 3 searches from the same index? You need to join all 3 searches into a single base search with an OR

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...