https://community.splunk.com/t5/Reporting/Create-a-report-with-two-different-time-ranges/m-p/413148#M6844 <P>I have a report created which analyzes my data over the past 30 days.</P> <P>Then I have a dashboard, with three different searches/panels that analyzes specific data over the last 24 hours.</P> <P>I would like to put the data from this dashboard into the same report. This would be highly convenient to see everything on one page by Id which is a field. If the data is not available for the past 24 hours, but exists over 30 days, that cell should be empty .</P> <P>More specifically, in the 30 day report I search for all units that have been online in the past 30 days, and then put them in a table.</P> <PRE><CODE>Id="*" Status="*" earliest=-30d latest=now | dedup Id | table _time Id customer Status Number_of_Days_Since_Comms </CODE></PRE> <P>in the dashboard, my three searches create sparklines or tables. </P> <PRE><CODE>Id="*" metrics1="0.0" |chart sparkline(avg(metrics1)) as "Metrics1 over 24 Hours" by Id Id="*" metrics2="0.0" |chart sparkline(avg(metrics2)) as "Metrics2 over 24 Hours" by Id Id="*" (metrics3&lt;="X" OR metrics4&lt;"Y") |table _time Id metrics3 metrics4 </CODE></PRE> <P>How can I combine these into a single report?</P> Tue, 23 Apr 2019 00:02:47 GMT vkmurthy 2019-04-23T00:02:47Z https://community.splunk.com/t5/Reporting/Create-a-report-with-two-different-time-ranges/m-p/413148#M6844 <P>I have a report created which analyzes my data over the past 30 days.</P> <P>Then I have a dashboard, with three different searches/panels that analyzes specific data over the last 24 hours.</P> <P>I would like to put the data from this dashboard into the same report. This would be highly convenient to see everything on one page by Id which is a field. If the data is not available for the past 24 hours, but exists over 30 days, that cell should be empty .</P> <P>More specifically, in the 30 day report I search for all units that have been online in the past 30 days, and then put them in a table.</P> <PRE><CODE>Id="*" Status="*" earliest=-30d latest=now | dedup Id | table _time Id customer Status Number_of_Days_Since_Comms </CODE></PRE> <P>in the dashboard, my three searches create sparklines or tables. </P> <PRE><CODE>Id="*" metrics1="0.0" |chart sparkline(avg(metrics1)) as "Metrics1 over 24 Hours" by Id Id="*" metrics2="0.0" |chart sparkline(avg(metrics2)) as "Metrics2 over 24 Hours" by Id Id="*" (metrics3&lt;="X" OR metrics4&lt;"Y") |table _time Id metrics3 metrics4 </CODE></PRE> <P>How can I combine these into a single report?</P> Tue, 23 Apr 2019 00:02:47 GMT https://community.splunk.com/t5/Reporting/Create-a-report-with-two-different-time-ranges/m-p/413148#M6844 vkmurthy 2019-04-23T00:02:47Z https://community.splunk.com/t5/Reporting/Create-a-report-with-two-different-time-ranges/m-p/413149#M6845 <P>I have no idea what you really need here. Please edit/comment and add much more detail.</P> Wed, 24 Apr 2019 06:52:56 GMT https://community.splunk.com/t5/Reporting/Create-a-report-with-two-different-time-ranges/m-p/413149#M6845 woodcock 2019-04-24T06:52:56Z