topic Re: Splunk combine timechart result from two queries in Splunk Search

Splunk combine timechart result from two queries

officialsubho — Wed, 30 Sep 2020 01:28:24 GMT

Have the following queries

query 1 - cf_org_name="xxx" cf_space_name="yyy" cf_app_name=zzz index=123* msg= "Transaction completed" | timechart count AS Succesfull_Tran span=60m

query 2 - cf_org_name="xxx" cf_space_name="yyy" cf_app_name=zzz index=123* msg= "ERROR" | timechart count AS Failed_Tran span=60m

Need help to combine the resultset into a single timechart table . Tried append and it dosent not give the desired output .

Desired Output

_time | Succesfull_Tran | Failed_Tran

Re: Splunk combine timechart result from two queries

jacobpevans — Mon, 29 Jul 2019 15:40:21 GMT

| timechart span=60m count by msg

You can also create a new variable and timechart by that

| eval Success = if(msg="Transaction Completed","Success","Error")
| timechart span=60m count by Success

Re: Splunk combine timechart result from two queries

Anantha123 — Wed, 30 Sep 2020 01:31:44 GMT

Hi,

Try this too

cf_org_name="xxx" cf_space_name="yyy" cf_app_name=zzz index=123*
| timechart span=1h count as Total , count(eval(msg="Transaction completed")) as Succesfull_Tran , count(eval(msg="ERROR")) as Failed_Tran

Re: Splunk combine timechart result from two queries

woodcock — Mon, 29 Jul 2019 18:17:46 GMT

Like this:

index="123*" AND cf_org_name="xxx" AND cf_space_name="yyy" AND cf_app_name="zzz" 
| timechart span=60m count(eval(msg="ERROR")) AS Failed_Tran count(eval(msg="Transaction completed")) AS Succesfull_Tran