Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Multiple sourcetypes with different lookup valaues in one search

$
0
0

I have clients that are identified differently in different sourcetypes but they all resolve to the same client name. I have a lookup table that has the different identifiers and their “friendly name”. The table looks like this:

 cs_username, site_id,   Client
 jacks-box1,  jacksonUp, Jacksonville
 macon-no2,   maconUp,   Macon 
 atl01,       atlantaUp, Atlanta

Sourcetypes are IIS Log files and a custom inventory log that is generated at each location and uploaded. I need to combine information from both sourcetypes into one table. I have a search that looks like this and it works perfectly for the IIS sourcetype. Note that this search has been obfuscated.

sourcetype="iis"  [inputlookup ClientList.csv | fields cs_username]
| eval Agent=cs_User_Agent_
| makemv delim=";" Agent | eval Data=mvindex(Agent,2) 
| makemv delim="/" Data 
| eval Open=mvindex(Data,0)
| eval Available=mvindex(Data,1)
| eval Hits=mvindex(Data,2)

| append [ search sourcetype="iis" [inputlookup ClientList.csv | fields cs_username] 
GET cs_uri_stem="*region*/Recvd*.pdf" 
| stats sum(sc_bytes) as Bytes by cs_username | eval MB=Bytes/1024/1024 | eval MB=round(MB,1)]

| append [search sourcetype="iis" [inputlookup ClientList.csv | fields cs_username] GET cs_uri_stem="*region*/Recvd*" .pdf| stats count(cs_uri_stem) as Recvd by cs_username]

| lookup ClientList.csv cs_username OUTPUT Client 
| stats first(Client) AS Client, first(Open) as Open, first(Available) as Available, first(Hits) as Hits, first(MB) as MB, first(Recvd) AS Recvd sum(eval(sc_bytes/1024/1024)) as MBs 
| fillnull value="0" Recvd MB 
| rename MB as "Recvd MB"
| table Client, Open, Available, Hits, Hours, Recvd, "Recvd MB"

The second append counts the number of PDF files the client received. The output looks like this:

ClientOpenAvailableHitsHoursRecvdMB Recvd
Jacksonville1260325.2518185
Atlanta920220.12975
Macon1401571.5127248

I have a new sourcetype called inventory that contains information about the PDF files the User was supposed to receive on any given day. The key field is site_id which, as can be seen in the lookup table above, is different than the cs_username in the IIS sourcetype. I need to insert a search that looks like this right before the second append, above.

| append [search sourcetype="inventory" del_date="13/05/*" [inputlookup ClientList.csv | fields site_id] .pdf| stats count(del_date) as Assign by site_id
| lookup ClientList.csv site_id OUTPUT Client]

This search, in and of itself works. I need to place the value “Assign” to the immediate left of the Recvd column. Then the output would look like this.

ClientOpenAvailableHitsHoursAssignRecvdMB Recvd
Jacksonville1260325.251818185
Atlanta920220.1210975
Macon1401571.512727248

For the life of me I can’t figure out how to make this append work. The overall search runs but the Assign column is always blank. I can add it to the fillnull function and get a zero for each record so I know that the field is being processed. I have included the field in the stats section.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>