Loading...
Skip to content
Warren Myers' Merikebi My online archive
  • RSS
  • Facebook
  • Instagram
  • Pinterest
  • Twitter
  • LinkedIn
  • GitHub
  • Telegram
  • Skype

Pages

  • Welcome to Warren Myers’ Merikebi
  • Pocket

Answer by warren for In Splunk, how do I efficiently map data from separate searches into the same row?

Posted on 6 September 2023

Pages

  • Welcome to Warren Myers’ Merikebi

What IS the common field across these events? IP address? Hostname? Something else?

Something along the lines of this will get you started:

index=ndx sourcetype=srctp ip=*
| fields - _raw
| fields _time ip req_id session_id app_id cust_id
| fillnull value="n/a" req_id session_id app_id cust_id
| stats count by ip req_id session_id app_id cust_id
| fields - count

or, perhaps:

index=ndx sourcetype=srctp ip=*
| fields - _raw
| fields _time ip req_id session_id app_id cust_id
| stats values(*) as * by ip

from User warren – Stack Overflow https://stackoverflow.com/questions/77048806/in-splunk-how-do-i-efficiently-map-data-from-separate-searches-into-the-same-ro/77053082#77053082
via IFTTT

merikebi

warrenmyers.com
Taggedstackexchange
by merikebiCategories:blih
  • RSS
  • Skype
© Warren Myers' Merikebi. All rights reserved.
Back to top