topic Re: combined timecharts in Splunk Search

combined timecharts

adomila — Fri, 06 Dec 2013 10:13:21 GMT

Hi,
I'm trying to combine 2 timecharts into just single graph

index=xxx (MTYP=0 RESL=0) OR (MTYP=1 RESL=0) OR (MTYP=4 RESL=0) | timechart count(_raw) as successful by host

index=xxx (MTYP=0 RESL=1) OR (MTYP=0 RESL=2) OR (MTYP=0 RESL=3) OR (MTYP=1 RESL=1) OR (MTYP=1 RESL=2) OR (MTYP=1 RESL=3) OR (MTYP=4 RESL=1) OR (MTYP=4 RESL=2) OR (MTYP=4 RESL=3) | timechart count(_raw) as failed by host

it tried this but got an error

index=xxx (MTYP=0 RESL=0) OR (MTYP=1 RESL=0) OR (MTYP=4 RESL=0) | stats count(_raw) as successful count(eval((MTYP=0 RESL=1) OR (MTYP=0 RESL=2) OR (MTYP=0 RESL=3) OR (MTYP=1 RESL=1) OR (MTYP=1 RESL=2) OR (MTYP=1 RESL=3) OR (MTYP=4 RESL=1) OR (MTYP=4 RESL=2) OR (MTYP=4 RESL=3))) as failed by _time

Re: combined timecharts

kristian_kolb — Fri, 06 Dec 2013 13:40:14 GMT

You could try a different approach;

index=xxx sourcetype=yyy MTYP=* RESL=* 
| eval outcome = case(((MTYP==0 AND RESL==0) OR (MTYP==1 AND RESL==0) OR (MTYP==4 AND RESL==0)), "success", ((MTYP==0 AND RESL==1) OR (MTYP==0 AND RESL==2) OR (MTYP==0 AND RESL==3) OR (MTYP==1 AND RESL==1) OR (MTYP==1 AND RESL==2) OR (MTYP==1 AND RESL==3) OR (MTYP==4 AND RESL==1) OR (MTYP==4 AND RESL==2) OR (MTYP==4 AND RESL==3)), "failed", 1==1, "unknown") 
| timechart span=1h count by outcome

Hope this helps,

Re: combined timecharts

adomila — Fri, 06 Dec 2013 17:31:03 GMT

Hi Kristian,
It didn't work the way I fully expect it to be but I got the idea and so I did some minor tweeks to suit my needs. Finally got it working now. Thanks a bunch.

Re: combined timecharts

kristian_kolb — Fri, 06 Dec 2013 18:07:20 GMT

good to hear, I didn't get to test it, so it was more off the top of my head.