topic Re: one report with two metrics in Splunk Search

one report with two metrics

vinod0313 — Tue, 18 May 2021 07:34:41 GMT

HI I have two queries ,and i need to display the results from the both the queries in one line graph report

Re: one report with two metrics

aasabatini — Tue, 18 May 2021 07:38:34 GMT

Hi @vinod0313

you can try to use a subsearch but be careful because subsearches works fine with a small set of data

https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchTutorial/Useasubsearch

anyway if you want share your searches or explain your case the community can help you better

Regards

Alessandro

Re: one report with two metrics

vinod0313 — Tue, 18 May 2021 10:11:38 GMT

HI @aasabatini

I am joining two queries in order to show both result in one graph,please refer below query

index="cx_aws" host="aw-lx0244.deltadev.ent" source ="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode|bucket _time span=1h | stats count by _time |append [search index="cx_aws" host="aw-lx0244.deltadev.ent" source="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode | eval TimeTaken3 = trim(replace(TimeTaken, ",","")) | eval REQUESTED_URL2 = trim(replace(REQUESTED_URL, "/contracts/",""))| eval REQUESTED_URL3 = trim(replace(REQUESTED_URL2, "/enrollees","")) | sort -num(TimeTaken3) | WHERE TimeTaken3>10000|bucket _time span=1h | stats count by _time]

But i am getting only one graph,in this graph only both query results are showing,refer below

but i need two lines (one for each query) in the graph

Re: one report with two metrics

aasabatini — Wed, 19 May 2021 11:55:30 GMT

Hi @vinod0313

sorry for the late reply.

I think you set the count field with the same name, try to modify the count name for each search.

example

index="cx_aws" host="aw-lx0244.deltadev.ent" source ="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode|bucket _time span=1h | stats count as search1_count by _time |append [search index="cx_aws" host="aw-lx0244.deltadev.ent" source="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode | eval TimeTaken3 = trim(replace(TimeTaken, ",","")) | eval REQUESTED_URL2 = trim(replace(REQUESTED_URL, "/contracts/",""))| eval REQUESTED_URL3 = trim(replace(REQUESTED_URL2, "/enrollees","")) | sort -num(TimeTaken3) | WHERE TimeTaken3>10000|bucket _time span=1h | stats count as search2_count by _time]