topic Re: Creating a table from diff source in All Apps and Add-ons

Creating a table from diff source

marinewcreater — Wed, 30 Sep 2020 03:14:57 GMT

HI Team,

I would like to create a table in a dashboard from two difference results.

Eg: Blue stack results and Green stack results has to display on a same table like below.

Green /t Blue

Service Call_count Service Call_count

Re: Creating a table from diff source

dindu — Wed, 04 Dec 2019 15:09:21 GMT

Do you have any specific requirements?
If not, please check on the join and append options.

https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Join
https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Append
https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/JoinCommandUsage

Please try and let us know!!

Re: Creating a table from diff source

marinewcreater — Wed, 30 Sep 2020 03:15:07 GMT

index = avb source = "blue | stats count by Service, Call_count
index = avb source = "Green | stats count by Service, Call_count

Is it possible to display both results in same table, as Header Green / Blue and next line header as Service / Call_count

Re: Creating a table from diff source

dindu — Wed, 04 Dec 2019 16:40:21 GMT

Hi,
Please check whether the below snippet is what you are looking for.

  index=avb source="blue" 
 |eval Blue_Green="Blue"
 |stats count as "Service_Call Count" by Service, Call_count ,Blue_Green
 |append [ search index=avb source="Green"
 |eval Blue_Green="Green"
 |stats count as "Service_Call Count" by Service, Call_count,Blue_Green]
  |fields - Service,Call_count