Splunk Search

How to aggregate results based on a set of values

alejandrome
New Member

Hello all,

I have the following query:

index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | table _time, resultValue1, resultValue2, resultValue3 | sort _time

Quick explanation of the fields:

  1. attr1/2: these are some filters which have constants. Those are "irrelevant" to my problem right now.
  2. filterCriteria: The above query has one value as a filter, but I need to filter by two values. This means something like filterCriteria in("Criteria1", "Criteria2").

For achieving this, I tried to use join of two separate queries, based on the filterCriteria attribute, like this:

index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | join filterCriteria [search index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria2"] | table _time, resultValue1, resultValue2, resultValue3 | sort _time

But it seems that it's returning only the values of the last part of the join instead.

resultValue1/2/3 are fields with values shared by both queries, so they can be aggregated.

Is there a most efficient/another way to achieve this filtering by multivalued / in-like criteria?

Thanks in advance!

0 Karma

TISKAR
Builder

Hello,

Why you don't use the IN to filter request:

index=_internal name IN ("management","ingest")

in your case:

index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" | table _time, resultValue1, resultValue2, resultValue3 | sort _time
0 Karma

to4kawa
Ultra Champion
(index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria1" ) OR (index=someIndex "attr1"=aConstant attr2="aValue" filterCriteria="Criteria2" ) 
| stats values(_time) as _time , values(resultValue1) as resultValues1, values(resultValue2) as resultValues2, values(resultValue3) as resultValues3 by filterCriteria 
| sort _time

try stats with by .

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...