topic Re: How to use time picker to display the data in this query with appendcols? in Splunk Search

How to use time picker to display the data in this query with appendcols?

lsy9891 — Tue, 17 Sep 2019 02:19:20 GMT

Hi, I have this query:

host="NETAPPA*" sourcetype="WinEventLog:Application" AND AppDomainName= "EcomSubscription.*"AND "ErrorGUID" | timechart span=1h count AS "EcomSubscription" | appendcols [search host=NETAPPA* sourcetype="WinEventLog:Application" AND LogName="Application" AND ExceptionManager_AppDomainName= "Monster.Services.Windows.ServiceBase.exe" | timechart span=1h count AS "MonsterWindowServices" ]

I changed the setting of the shared time picker to last 24 hours and the chart just returns null but when I changed the setting to last 7 days there are results. But from the 7-day results it shows that 'Monster window services' is not null for the last 24 hours. Is it because of the appendcols?

EDIT:I realized when ecomsubsription is null monster window services does not display as well eventhough it is not null? Is there a way to avoid appendcols altogether?

Re: How to use time picker to display the data in this query with appendcols?

adonio — Tue, 17 Sep 2019 02:50:51 GMT

not sure why appending, seems like you are almost searching for the same things, and now all it needed is to sort the counts over time by the "unique search stings"

try this:

(index = <YOUR INDEX HERE> host="NETAPPA*" sourcetype="WinEventLog:Application" AppDomainName= "EcomSubscription.*" "ErrorGUID") OR  (index = <YOUR INDEX HERE> host="NETAPPA*" sourcetype="WinEventLog:Application" LogName="Application" AND ExceptionManager_AppDomainName="Monster.Services.Windows.ServiceBase.exe") 
| timechart span=1h count(eval(AppDomainName="Monster.Services.Windows.ServiceBase.exe")) as "MonsterWindowServices" count(eval(like(AppDomainName, "EcomSubscription.%"))) as "EcomSubscription"

note: i think there are more consolidation options there, as your search might be "glued" at: ExceptionManager_AppDomainName but i wasnt sure

hope it helps

Re: How to use time picker to display the data in this query with appendcols?

lsy9891 — Wed, 18 Sep 2019 07:06:17 GMT

Hi I tried the query but it returns 0 results

Re: How to use time picker to display the data in this query with appendcols?

lsy9891 — Wed, 18 Sep 2019 07:08:44 GMT

Ok its incorrect because monster window services has 0 results

Re: How to use time picker to display the data in this query with appendcols?

adonio — Wed, 18 Sep 2019 09:32:29 GMT

@lsy9891 not sure i understand,
if it works for you, kindly mark the question as answered, so others will know.
if it doesnt, please elaborate on what isnt working for you