topic Re: Merging results from two different searches in one fill chart in Splunk Search

Merging results from two different searches in one fill chart

jbouch03 — Mon, 28 Sep 2020 15:25:33 GMT

My company is currently trying to archive a large amount of older files; however, new files are coming in daily. We would like to know our percentage of files that have been archived is versus the total (to include the new images). I have both search results, but I can't seem to put them together. I'm pretty new to Splunk, and I tried using a join but I couldn't seem to figure it out so any assistance would be appreciated. Thank you in advance.

Search 1:
sourcetype="log.txt-3" status="*" | stats count as currProc | eval totalProc=(currProc+1525036) | eval percentage=round(totalProc*100/34937175,1) | stats sum(percentage)

Search 2:
source="C:\xxxxxx\serverstatus.log" successWrite="*" | stats count as new | eval totalDCM=(new+34937175) | stats sum(totalDCM)

My goal is to add Search 2 to the percentage area, since Search 1 already does the percentage calculations.

Re: Merging results from two different searches in one fill chart

jordanperks — Mon, 28 Sep 2020 15:25:38 GMT

I dont know if this is the most efficient way to do things, but here is how I merged two searches:

You will see the 2nd search here: "eval search=[search sourcetype=cisco:ios AND %FW-6-DROP_PKT earliest=-24h@m latest=now | stats count(src_ip_zbfw) | rename count(src_ip_zbfw) as search]"

Re: Merging results from two different searches in one fill chart

jbouch03 — Fri, 06 Dec 2013 14:50:39 GMT

That worked...thanks. I really appreciate it. My final search string was:

sourcetype="log.txt-3" status="*" | stats count as currProc | eval totalProc=(currProc+1525036) | eval search=[search source="C:\\xxxxx\\serverstatus.log" successWrite="*" | chart count as total | eval search=(total+34937175)] | rename search as totalDCM | eval percentage=round(totalProc*100/totalDCM,1) | stats sum(percentage)

Thanks again!!