topic Re: I want to merge my data into single row, also I want to add the trendchart based on the date/time, please check below the more details. in Splunk Search

I want to merge my data into single row, also I want to add the trendchart based on the date/time, please check below the more details.

krsuraj11 — Wed, 17 Jul 2019 15:52:02 GMT

index="indexsplunk" host=host* tag="Failure" "Transaction" | stats count as Total
|append [search index="indexsplunk" host=host* tag="Failure" "EFGH" | stats count as Total]

Right now, output is displaying in 2 rows, since I append so one more row added for 2nd search. Please help me getting the data populated in one field and also suggest how to add the date while searching.

Re: I want to merge my data into single row, also I want to add the trendchart based on the date/time, please check below the more details.

grittonc — Wed, 17 Jul 2019 16:50:24 GMT

Do the two rows have anything in common?

Re: I want to merge my data into single row, also I want to add the trendchart based on the date/time, please check below the more details.

adonio — Wed, 17 Jul 2019 23:14:29 GMT

try this:

(index="indexsplunk" host=host* tag="Failure" "Transaction" ) OR (index="indexsplunk" host=host* tag="ABCD" "EFGH") 
| stats count(eval(tag=="Failure")) as fail_count count(eval(tag=="ABCD")) as adcd_count

Re: I want to merge my data into single row, also I want to add the trendchart based on the date/time, please check below the more details.

krsuraj11 — Thu, 18 Jul 2019 07:32:48 GMT

Yes, Index, Host and Tag are common, please help

Re: I want to merge my data into single row, also I want to add the trendchart based on the date/time, please check below the more details.

krsuraj11 — Thu, 18 Jul 2019 07:34:08 GMT

Hi, it gives me the 0 result, actually tag is common for both, can you please check again.

Re: I want to merge my data into single row, also I want to add the trendchart based on the date/time, please check below the more details.

adonio — Wed, 30 Sep 2020 01:20:10 GMT

try and use this formula, here i use wild cards in eval %Fail% you might not need.

| makeresults count=1000
| eval random_for_text = random()%2
| eval text_to_search = if(random_for_text=="0","Failure","EFGH")
| stats count(eval(like(text_to_search,"%Fail%"))) as fail_count count(eval(like(text_to_search, "%EF%"))) as efgh_count

in your case itll be maybe something like this:
index="indexsplunk" host=host* tag="Failure" "Transaction" ("Failure" OR "EFGH")
| stats count(eval(like(_raw,"Failure"))) as fail_count count(eval(like(_raw, "EFGH"))) as efgh_count
hope it helps