topic Query help with search using sum(count) and 2 subsearches using count in Splunk Search

Query help with search using sum(count) and 2 subsearches using count

subtrakt — Mon, 28 Sep 2020 17:04:28 GMT

I have a query that combines 1 search and 2 sub-searches. The main search is a summary index and sum(count) in the timechart to look right. The 2 sub searches do not need sum(count) - they just need "count" so they are represented properly on the timechart.

I was thinking if there was a way to convert sum(count) to count I would be good.

This summary index runs every 15 minutes and buckets by the minute:

Without the subsearch the search would look like this and works as intended:
index="summary_onemin" error | timechart sum(count) as COUNT by CODE

Re: Query help with search using sum(count) and 2 subsearches using count

somesoni2 — Tue, 15 Jul 2014 15:51:33 GMT

Can you post your full search?

Re: Query help with search using sum(count) and 2 subsearches using count

somesoni2 — Tue, 15 Jul 2014 21:00:30 GMT

Try this

 index="summary_onemin" error | table _time CODE count 
| append [search index=power_user "null" | bucket _time span=2m | eval CODE=powerNULL
| stats count by _time, CODE] 
| timechart span=2m sum(count) as count by CODE

Re: Query help with search using sum(count) and 2 subsearches using count

subtrakt — Tue, 15 Jul 2014 23:45:48 GMT

Thanks Somesoni!