topic Re: How to combine multiple reports? in Reporting

How to combine multiple reports?

suchi01 — Thu, 30 Jan 2020 13:15:23 GMT

Hello Splunkers,

I have a scenario in which I have generated two reports - 1) First one shows data for last 6 months, visualized as a line chart (Data is:- count of total movie releases and total hit movies )
2) Second shows data of last for last 6 month, visualized as line chart (data is :- count of Hindi movies , English movies, Telugu movies)

Is it possible to combine these two reports?
If yes please guide me how this could be done.

Re: How to combine multiple reports?

richgalloway — Thu, 30 Jan 2020 14:26:56 GMT

There are a few ways to combine reports. Please share your queries so we can offer solutions.

Re: How to combine multiple reports?

DalJeanis — Fri, 31 Jan 2020 22:41:16 GMT

You can start with something like this...

Your search that finds all of each movie 
| eval TotalCount=1
| eval HitCount=if (this is a hit,1,0)
| eval HindiCount= if (this is Hindi,1,0)
| eval TeluguCount= if (this is Telugu,1,0)
| eval EnglishCount= if (this is English,1,0)
| timechart sum(*Count) as *Count
| rename *Count as *

Re: How to combine multiple reports?

to4kawa — Sat, 01 Feb 2020 01:13:27 GMT

Sample:

| gentimes start=01/01/2019
| eval _time=starttime
| timechart span=1month count
| eval total_movie_releases=random() % 100 + count ,hit_movies=random() % 10 + count
| sort 6 - _time
| fields - count
`comment("this is your first query sample")`
| append [| gentimes start=01/01/2019
| eval _time=starttime
| timechart span=1month count
| eval Hindi_movies=random() % 50 + count , English_movies=random() % 40 + count , Telugu_movies=random() % 10 + count 
| sort 6 - _time
| fields - count]
`comment("this is your second query sample")`
`comment("from here, the logic")`
| selfjoin _time

Recommend:

your_first_query
| append [ search your_second_query ]
| selfjoin _time

Hi, @suchi01
I don't know your query details. This works.
But it's slow, maybe.

Re: How to combine multiple reports?

suchi01 — Mon, 03 Feb 2020 08:41:04 GMT

I have 2 reports :-

1) First report represents data of hit and flop movies for last 1 month in pie-chart.

2) Second report represents data of hindi hit/flop, english hit/flop, telugu hit/flop.

I need to combine these 2 reports and get all data displayed in one screen. i.e. I need one pie chart showing total hit and flop movies and other 3 pie charts showing hindi hit/flop, english hit/flop, telugu hit/flop.