https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542951#M153804 <P>Do you have anything before the search you sent us? If yes, we should find another way to do it.</P> Tue, 09 Mar 2021 07:01:35 GMT scelikok 2021-03-09T07:01:35Z https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542796#M153758 <P>Hello,</P><P>I want total of multiple searches in timechart per week.</P><P>My search in simple format last 90 days:</P><LI-CODE lang="markup">| inputlookup abcd.csv | search host=*CC* | dedup host | stats count(host) as "List1" | appendcols [| inputlookup efgh.csv | search host=*AA* | dedup host | stats count(host) as "List2"] | appendcols [| inputlookup xyz1.csv | search host=*BB* | dedup host | stats count(host) as "List3"] | eval Total=List1+List2+List3 | timechart span=w@1w sum(Total) as "Hosts"</LI-CODE><P>If I run it without last timechart line, then it gives me total for 90 days or 1 week, but I need same results calculated weekly using timechart, and display total per week.&nbsp;</P> Mon, 08 Mar 2021 08:35:48 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542796#M153758 utk123 2021-03-08T08:35:48Z https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542831#M153763 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/93258">@utk123</a>,</P><P>Assuming you have _time field in all your lookup files you can try something like below;</P><LI-CODE lang="markup">| inputlookup abcd.csv where host="*CC*" | eval list="List1" | inputlookup append=t efgh.csv where host="*AA*" | eval list=coalesce(list,"List2") | inputlookup append=t xyz1.csv where host="*BB*" | eval list=coalesce(list,"List3") | bin _time span=w@1w | stats dc(host) as host_count by list _time | timechart span=w@1w sum(host_count) as Total</LI-CODE> Mon, 08 Mar 2021 14:21:01 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542831#M153763 scelikok 2021-03-08T14:21:01Z https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542945#M153802 <P>I get below error:</P><P>Error in 'inputlookup' command: This command must be the first command of a search.</P> Tue, 09 Mar 2021 06:28:22 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542945#M153802 utk123 2021-03-09T06:28:22Z https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542949#M153803 <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/93258">@utk123</a><BR /><BR />timechart command will work with _time field. Does your lookups has any date time column like host_created_date , etc... ?<BR /><BR /><A href="https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Timechart" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.2/SearchReference/Timechart</A> Tue, 09 Mar 2021 06:48:38 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542949#M153803 kamlesh_vaghela 2021-03-09T06:48:38Z https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542951#M153804 <P>Do you have anything before the search you sent us? If yes, we should find another way to do it.</P> Tue, 09 Mar 2021 07:01:35 GMT https://community.splunk.com/t5/Splunk-Search/Timechart-for-multiple-search-total/m-p/542951#M153804 scelikok 2021-03-09T07:01:35Z