https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-searches-and-make-a-single-timechart/m-p/219138#M176217 <P>Hey,</P> <P>i'm trying to merge/join 2 searches into 1, and create a table of the data.</P> <P>this is my starting query:</P> <P>index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | table _time,ID,field1,field2,field3,field4,field5</P> <P>with this query i can get the minutely data.</P> <P>what i need is an hourly data, something like timechart span=1h does.<BR /> but my problem is that i need an hourly data for every hour for fields1-5, so timechart is not good for me.<BR /> (e.g i need timechart max(avg(field1),field2,...,field5) by ID but timechart supports only one field)</P> <P>i have tried using bucket like this:</P> <P>index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | bucket _time span=1h | table _time,ID,field1,field2,field3,field4,field5</P> <P>but what i get is the same time for all the lines.</P> <P>my wish is to have something like this:<BR /> index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | table _time,ID,field1,field2,field3,field4,field5 | timechart avg(field1),avg(field2),avg(field3),avg(field4),avg(field5) by ID span=1h</P> <P>bu again, timechart does not support multiple fields.</P> <P>so my question is:<BR /> 1. how to merge 2 searches into one large table?<BR /> 2. how to make the span of that large table become 1h?</P> <P>Thank you!!</P> Mon, 14 Nov 2016 07:38:09 GMT naty 2016-11-14T07:38:09Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-searches-and-make-a-single-timechart/m-p/219138#M176217 <P>Hey,</P> <P>i'm trying to merge/join 2 searches into 1, and create a table of the data.</P> <P>this is my starting query:</P> <P>index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | table _time,ID,field1,field2,field3,field4,field5</P> <P>with this query i can get the minutely data.</P> <P>what i need is an hourly data, something like timechart span=1h does.<BR /> but my problem is that i need an hourly data for every hour for fields1-5, so timechart is not good for me.<BR /> (e.g i need timechart max(avg(field1),field2,...,field5) by ID but timechart supports only one field)</P> <P>i have tried using bucket like this:</P> <P>index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | bucket _time span=1h | table _time,ID,field1,field2,field3,field4,field5</P> <P>but what i get is the same time for all the lines.</P> <P>my wish is to have something like this:<BR /> index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | table _time,ID,field1,field2,field3,field4,field5 | timechart avg(field1),avg(field2),avg(field3),avg(field4),avg(field5) by ID span=1h</P> <P>bu again, timechart does not support multiple fields.</P> <P>so my question is:<BR /> 1. how to merge 2 searches into one large table?<BR /> 2. how to make the span of that large table become 1h?</P> <P>Thank you!!</P> Mon, 14 Nov 2016 07:38:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-searches-and-make-a-single-timechart/m-p/219138#M176217 naty 2016-11-14T07:38:09Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-searches-and-make-a-single-timechart/m-p/219139#M176218 <P>How about this</P> <PRE><CODE>index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla | join type=left max=1 [search index=myapp source="mysource" earliest=1477810800 latest=1477821600 | extract REPORT-blabla2] | table _time,ID,field1,field2,field3,field4,field5 | bucket span=1h _time | stats avg(*) as * by _time ID </CODE></PRE> Mon, 14 Nov 2016 17:02:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-searches-and-make-a-single-timechart/m-p/219139#M176218 somesoni2 2016-11-14T17:02:51Z