topic Custom search using timechart in Splunk Enterprise

Custom search using timechart

vishwa — Sat, 02 Mar 2024 23:10:39 GMT

Query:

index=new "application status" AND Condition=Begin OR Condition=Done
|rex field = _raw "DIDS \s+\[?<data>[^\]]+)"
|dedup data
|timechart span=1d count by application

Result:

_time	application1	application2
2022-01-06	10	20
2022-01-07	12	14
2022-01-08	18	30

I want to include Condition field as well in the table, how can i do it???

Re: Custom search using timechart

bowesmana — Sun, 03 Mar 2024 21:47:01 GMT

You can generally do this by concatenating the two data items into a single field for the split by clause of the timechart, i.e.

... | eval split=application.":".Condition | timechart span=1d count by split

Re: Custom search using timechart

vishwa — Wed, 06 Mar 2024 02:46:41 GMT

Thank you @bowesmana it worked

Re: Custom search using timechart

bowesmana — Wed, 06 Mar 2024 03:59:32 GMT

@vishwa can you mark it as a solution so others can see it as a valid solution