How to combine multiple chart queries into one?

VikhyathMaiya — Fri, 18 Feb 2022 16:09:27 GMT

Hello splunk community. As on today we have two queries that are running

Count of api grouped by apiName and status

index=aws* api.metaData.pid="myAppName" | rename api.p as apiName | chart count BY apiName "api.metaData.status" | multikv forceheader=1 | table apiName success error NULL

Which displays a table something like shown below
=====================================
| apiName || success || error || NULL. |
====================================
| Test1 || 10 || 20. || 0 |
| Test2 || 10 || 20. || 0 |
| Test3 || 10 || 20. || 0 |
| Test4 || 10 || 20. || 0 |
| Test5 || 10 || 20. || 0 |
| Test6 || 10 || 20. || 0 |

latency of api grouped by apiName

index=aws* api.metaData.pid="myAppName" | rename api.p as apiName | rename api.measures.tt as Response_Time | chart min(Response_Time) as RT_fastest max(Response_Time) as RT_slowest by apiName | table apiName RT_fastest RT_slowest

which displays a table something like below

==================================

| apiName || RT_fastest || RT_slowest

==================================

| Test1 || 10 || 20. |

| Test2 || 10 || 20. |

| Test3 || 10 || 20. |

| Test4 || 10 || 20. |

| Test5 || 10 || 20. |

| Test6 || 10 || 20. |

Question:

If you see the above tables, both tables are grouped with apiName. Is there a way to combine these queries so that i get a single result something like this

|===============================================

| apiName || success || error || NULL || RT_fastest. || RT_slowest |

===============================================

| Test1 || 10 || 20. || 20. || 20. || 20. ||
| Test2 || 10 || 20. || 20. || 20. || 20. ||
| Test3 || 10 || 20. || 20. || 20. || 20. ||
| Test4 || 10 || 20. || 20. || 20. || 20. ||
| Test5 || 10 || 20. || 20. || 20. || 20. ||

I could not find any documentation regarding combining multiple chart query into one. Could someone please help me with this. Thanks 🙂

Re: Combining multiple chart queries into one

ITWhisperer — Fri, 18 Feb 2022 16:03:24 GMT

This is essentially the same problem as has been answered here https://community.splunk.com/t5/Splunk-Search/Appending-tp99-as-a-new-column-in-the-existing-query/m-p/585721/highlight/true#M204071 You have to do the stats which are aggregated by apiName first and concatenate it to the apiName, then do the stats which are aggregated by apiName and status, then split out the stats which were aggregated by just apiName

topic Re: Combining multiple chart queries into one in Splunk Search

How to combine multiple chart queries into one?

Re: Combining multiple chart queries into one