Splunk Search

Append command not working to combine two searches with the same result but events occurred in two different timespans

kanj
New Member

Hello there,

Step1:
user software_name dc_today dc_past
A XYZ.exe 1 9
B PQR.exe 2 3
C DTA.exe 0 1

The final result should be:
user software_name dc_today
A XYZ.exe 1

My method:
index=* _index_earliest=-1d |stats dc(user) as dc by software_name |eval dc_today=if(dc=1, 1, 0)
|append [search index=* _index_earliest=-5d |stats dc(user) as dc by software_name |eval dc_past=if(dc=1,1,0)]
|table user software_name dc_today dc_past

So I am running two similar searches with differences in timespan.
1) Append is not reflecting the sub-search
2) Is there more efficient way for this?

Thanks in advance!
KanJ

0 Karma

to4kawa
Ultra Champion
 index=* earliest=-1d 
| stats dc(user) as dc by software_name 
| eval dc_today=if(dc=1, 1, 0) 
| append 
    [ search index=* earliest=-5d 
    | stats dc(user) as dc by software_name 
    | eval dc_past=if(dc=1,1,0)] 
| table user software_name dc_today dc_past

The user of your query is disappear. because stats aggregates.

index=* earliest=-5d 
| stats dc(eval(if(related_time(now(),"-1d") <= _time,user,NULL))) as dc_today dc(user) as dc_past by software_name 

Unique user count in software name is above.

The final result should be:
user software_name dc_today
A XYZ.exe 1

What's your logic?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...