{"id":46446,"date":"2021-10-25T17:32:27","date_gmt":"2021-10-25T17:32:27","guid":{"rendered":"https:\/\/merikebi.warrenmyers.com\/?p=46446"},"modified":"2021-10-25T17:32:27","modified_gmt":"2021-10-25T17:32:27","slug":"answer-by-warren-for-splunk-return-one-or-true-from-a-search-use-that-result-in-another-search","status":"publish","type":"post","link":"https:\/\/merikebi.warrenmyers.com\/?p=46446","title":{"rendered":"Answer by warren for Splunk: Return One or True from a search, use that result in another search"},"content":{"rendered":"

First … don’t dedup<\/code><\/a> on _raw<\/code><\/p>\n

The _raw<\/code> events are never<\/em> duplicated (unless you’ve done something wrong on ingest)<\/p>\n

Second, to your actual question – try something along the lines of this:<\/p>\n

index="myIndex" "started with profile" BD_L* \n| eval Platform=case(match(_raw,"LINUX"),"LINUX",match(_raw,"AIX"),"AIX",match(_raw,"DB2"),"DB2", match(_raw,"SQL"),"SQL", match(_raw,"WEBSPHERE"),"WEBSPHERE", match(_raw,"SYBASE"),"SYBASE", match(_raw,"WINDOWS"),"WINDOWS", true(),"ZLINUX") \n| stats count by Platform RUNID\n| join type=left RUNID\n    [ search index="myIndex" source="\/*\/RUNID\/*" CASE("ERROR") CTJT*\n        | stats count by RUNID\n    ]\n| stats count by Platform\n<\/code><\/pre>\n
If you can provide some sample data from your two indices, we can get you much<\/em> closer to a good solution – but this should move you towards an answer<\/p>\n
There’s likely<\/em> a way to not<\/em> use join<\/code><\/a> in this search – but we need sample data to verify that \ud83d\ude42<\/p>\n
from User warren – Stack Overflow https:\/\/stackoverflow.com\/questions\/69707314\/splunk-return-one-or-true-from-a-search-use-that-result-in-another-search\/69712393#69712393
\nvia IFTTT<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
First … don’t dedup on _raw The _raw events are never duplicated (unless you’ve done something wrong on ingest) Second, to your actual question – try something along the lines of this: index="myIndex" "started with profile" BD_L* | eval Platform=case(match(_raw,"LINUX"),"LINUX",match(_raw,"AIX"),"AIX",match(_raw,"DB2"),"DB2", match(_raw,"SQL"),"SQL", match(_raw,"WEBSPHERE"),"WEBSPHERE", match(_raw,"SYBASE"),"SYBASE", match(_raw,"WINDOWS"),"WINDOWS", true(),"ZLINUX") | stats count by Platform RUNID | join type=left RUNID …
Continue reading Answer by warren for Splunk: Return One or True from a search, use that result in another search<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4],"tags":[991],"keyring_services":[],"class_list":["post-46446","post","type-post","status-publish","format-standard","hentry","category-blih","tag-stackexchange"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/46446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=46446"}],"version-history":[{"count":1,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/46446\/revisions"}],"predecessor-version":[{"id":46447,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=\/wp\/v2\/posts\/46446\/revisions\/46447"}],"wp:attachment":[{"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=46446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=46446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=46446"},{"taxonomy":"keyring_services","embeddable":true,"href":"https:\/\/merikebi.warrenmyers.com\/index.php?rest_route=%2Fwp%2Fv2%2Fkeyring_services&post=46446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}