topic timechart overlay multiple strings in Splunk Search

timechart overlay multiple strings

sunil_sharma — Fri, 20 Sep 2013 18:43:49 GMT

I want to search 2 strings in log file, like "A string" & "B String", A string should be treated as successful and B as Failure. Next I want to overlay both as line timechart, where successful events should go above x-axis and Failure events go below x-axis or they are showed as different colors.How this can be done?

Re: timechart overlay multiple strings

lguinn2 — Fri, 20 Sep 2013 22:25:20 GMT

There are many ways, but this might be easiest.

source=logfilename "A string"
| eval series = "Success"
| append [ search source=logfilename "B string"
     | eval series = "Failure" ]
| timechart count by series

Re: timechart overlay multiple strings

SaiSirisha — Fri, 06 Mar 2015 08:44:50 GMT

Thank you Iguinn,
It almost worked but how do I give alias to search string? My timechart shows Success and failure which I don't wanna show instead I want to give alias to them and also span for a day,Hi Thank you for your answer it almost worked but how do I give alias for search string and search for span of a 1day

Re: timechart overlay multiple strings

SaiSirisha — Fri, 06 Mar 2015 09:04:21 GMT

How can I do a timechart with 2 strings and also give a Alias names to the string . How can span the reults for 1 day within same query?

Re: timechart overlay multiple strings

laserval — Fri, 06 Mar 2015 12:56:58 GMT

You should post this as a new question, or a comment, instead of an answer to the top question.

But to answer your answer: You can create an alias (called a search macro in Splunk) for a search string in the GUI under Settings - Advanced Search - Search Macros. To use the macro once it's been created, you have to surround your macro with backticks, like this: myawesomemacro(). The parenthesis are best to include, since there are cases where they are required even if you have no arguments.

As for span, you can use span=1d. Check the timechart search command help and you will find thespan option along with some example usage.

Re: timechart overlay multiple strings

SaiSirisha — Mon, 09 Mar 2015 07:40:02 GMT

Hi,
I knew that I had to post as new question and I even tried but continously gave me form error. That the reason I posted my question as an answer.

Anyways Thank you so much for the reply. it worked.
Sorry for inconvenience caused.