Splunk Search

Merging multiple indexers and providing report

runiyal
Path Finder

I need to create a report based on three different search criteria from three different sources. But since its a reconciliation report from three different systems, I need to make sure I present it in one report itself.

index=abc host="server-abc*" "upload succeeded" env=prd 

index=klm host="server-klm*" "index file" "*_prd.xml" 

index=xyz host="server-xyz*" "file uploaded" "Status code  : {}200"

The output/report I am trying to achieve is -

   Index    Count
    abc    100
    klm       89
    xyz     98

Will appreciate your ideas to achieve this.

Tags (3)
0 Karma

adonio
Ultra Champion
(index=abc host="server-abc*" "upload succeeded" env=prd) OR

(index=klm host="server-klm*" "index file" "*_prd.xml")  OR

 (index=xyz host="server-xyz*" "file uploaded" "Status code  : {}200")

| stats count by index
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...