topic Re: How can I combine two different chart queries into a single and get count in Splunk Search

How can I combine two different chart queries into a single and get count

rkishoreqa — Mon, 13 Sep 2021 10:35:41 GMT

Hi all,

I have two chart queries to get the success count and error count which are working as expected. Now I want to add the both and get the total count from both columns.

Query 1: index=dev | rex "\"tracePoint\\\\\"\s:\s\\\\\"(?<tracePoint>[^\\\]+)" | rex "\"correlationId\\\\\"\s:\s\\\\\"(?<correlationId>[^\\\]+)" |search app="project1" OR app="project2" OR app="project3" OR app="project4" |where tracePoint="EXCEPTION" |chart count(app) over app by dc(correlationId)

Query 2: index=dev | rex "\"tracePoint\\\\\"\s:\s\\\\\"(?<tracePoint>[^\\\]+)" | rex "\"correlationId\\\\\"\s:\s\\\\\"(?<correlationId>[^\\\]+)" |search app="project1" OR app="project2" OR app="project3" OR app="project4" |where tracePoint="END" |chart count(app) over app by dc(correlationId)

I tried with 'appendcols', but it is not working, can anyone help me on this.

Thanks in Advance.

Re: How can I combine two different chart queries into a single and get count

ITWhisperer — Mon, 13 Sep 2021 10:48:52 GMT

Try something like this

index=dev | rex "\"tracePoint\\\\\"\s:\s\\\\\"(?<tracePoint>[^\\\]+)" | rex "\"correlationId\\\\\"\s:\s\\\\\"(?<correlationId>[^\\\]+)" |search app="project1" OR app="project2" OR app="project3" OR app="project4" |where tracePoint="EXCEPTION" OR tracePoint="END" |chart count(app) over app by tracePoint| addtotals

Re: How can I combine two different chart queries into a single and get count

rkishoreqa — Mon, 13 Sep 2021 11:15:13 GMT

Thanks @ITWhisperer
It worked like a charm.