topic Re: Hi, I am facing problem with multiple subqueries in timechart. it is not showing the value for _time field. in Splunk Search

Hi, I am facing problem with multiple subqueries in timechart. it is not showing the value for _time field.

toabhishek16 — Tue, 30 Sep 2014 11:15:20 GMT

Query "index=idx1 sourcetype=src1 sender="xyz" | timechart count as res1" showing results properly, and

Query "index=idx1 sourcetype=src1 sender="abc" | timechart count as res2" not showing any result.

when I am trying to combine both the queries as below:
index=idx1 sourcetype=src1 sender="xyz" | timechart count as res1 | appendcols [search index=idx1 sourcetype=src1 sender="abc" | timechart count as res2] | fillnull res1, res2

it is giving result, but no value for _time field .

how I can get values for _time field.

pls help me....

Re: Hi, I am facing problem with multiple subqueries in timechart. it is not showing the value for _time field.

linu1988 — Tue, 30 Sep 2014 11:24:57 GMT

Hello,
Rather than appending the result

just do the below

index=idx1 sourcetype=src1 OR sourcetype=src2|timechart count by sourcetype

Thanks,
L

Re: Hi, I am facing problem with multiple subqueries in timechart. it is not showing the value for _time field.

somesoni2 — Tue, 30 Sep 2014 12:03:03 GMT

Try something like this

index= idx1 sourcetype=src1 sender="abc" OR sender="xyz" | timechart count(eval(sender="abc") as res1 count(eval(sender="xyz") as res2

Re: Hi, I am facing problem with multiple subqueries in timechart. it is not showing the value for _time field.

ltrand — Tue, 30 Sep 2014 15:27:11 GMT

Joined Query
"index=idx1 sourcetype=src1 sender="xyz" OR sender="abc" | timechart count by sender

This is significantly more efficent than the options above. It makes a single pass in the index and sourcetype to pull the data and populates the chart. Before you have to query the same data twice to pull information. Then you have to join the two results before charting.