{"id":34924,"date":"2021-04-20T13:13:33","date_gmt":"2021-04-20T13:13:33","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=34924"},"modified":"2021-04-20T13:13:33","modified_gmt":"2021-04-20T13:13:33","slug":"answer-by-warren-for-how-to-add-multile-query-in-one-query-in-splunk","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=34924","title":{"rendered":"Answer by warren for How to add multile query in one query in splunk"},"content":{"rendered":"

First, since index=...<\/code> is unique, there is not reason to add the index!=...<\/code> clauses. Data in Splunk can only exist in a single index (with a single sourcetype).<\/p>\n

So your first SPL should read:<\/p>\n

(index=abc OR index=def) (blocked=* OR RuleAction=*)\n| eval result=case(blocked=="0","Total Detection",blocked=="1","Total Blocked",blocked=="2","Would have Dropped",RuleAction=="Allow","Total Detection",RuleAction=="Block","Total Blocked")\n| stats count by result\n<\/code><\/pre>\n
You second SPL should read:<\/p>\n
index=abc Category=* (blocked=* OR RuleAction=*)\n| eval result=case(blocked=="0","Allowed",blocked=="1","Blocked",blocked=="2","Would have Dropped",RuleAction=="Allow","Allowed",RuleAction=="Block","Blocked")\n<\/code><\/pre>\n
note: | chart count by index, result usenull=f<\/code> is only<\/strong><\/em> going to list abc<\/code> for your index, since that’s the only place data is coming from … probably not an especially useful<\/em> chart<\/code> command here \ud83d\ude42<\/p>\n
| append\n    [ search index=def (blocked=* OR RuleAction=*)\n    | eval result=case(blocked=="0","Allowed",blocked=="1","Blocked",blocked=="2","Would have Dropped",RuleAction=="Allow","Allowed",RuleAction=="Block","Blocked")\n    ]\n<\/code><\/pre>\n
But why do the eval<\/code>s in the second SPL, since they’re instantly being thrown away by chart<\/code>?<\/p>\n
This would be much simpler:<\/p>\n
((index=abc Category=*) OR index=def) (blocked=* OR RuleAction=*)\n| chart count by index, result usenull=f\n<\/code><\/pre>\n
But what are you actually<\/em> trying to accomplish with the theoretical SPL?<\/p>\n
As it stands … you’re going to get a two-item chart<\/code> indicating counts from two indices.<\/p>\n
from User warren – Stack Overflow https:\/\/stackoverflow.com\/questions\/67174465\/how-to-add-multile-query-in-one-query-in-splunk\/67179600#67179600
\nvia IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
First, since index=… is unique, there is not reason to add the index!=… clauses. Data in Splunk can only exist in a single index (with a single sourcetype). So your first SPL should read: (index=abc OR index=def) (blocked=* OR RuleAction=*) | eval result=case(blocked=="0","Total Detection",blocked=="1","Total Blocked",blocked=="2","Would have Dropped",RuleAction=="Allow","Total Detection",RuleAction=="Block","Total Blocked") | stats count by result You …
Continue reading Answer by warren for How to add multile query in one query in splunk<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-34924","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/34924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=34924"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/34924\/revisions"}],"predecessor-version":[{"id":34925,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/34924\/revisions\/34925"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=34924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=34924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=34924"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=34924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}