topic Re: How to merge multiple query in single output in Splunk Search

How to merge multiple query in single output

twh1 — Wed, 29 Mar 2017 10:15:17 GMT

I have 5 query merged in single output. In statistics tab I am getting expected values. But in visualization tab when i am selecting bar chart for this table, first column value is displaying on x-axis as field name as x-axis label which should display as bar chart.
I have attached the screenshot. In this bottom table we can see 5 fields but in legend we can see only 4. Carecredit is showing as x-axis label.

Expected Result: All 5 field count in bar chart.

Note: I am getting correct result if I am using timechart rather than stats command.

Re: How to merge multiple query in single output

koshyk — Tue, 29 Sep 2020 13:28:58 GMT

what is your timechart parameters?
You might be just doing a | stats count

but rather do "by"
| stats count by your_product_field

Re: How to merge multiple query in single output

niketn — Wed, 29 Mar 2017 11:01:14 GMT

@twh1... this exact scenario has been explained as a use case in Splunk documentation for transpose command. https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transpose

Your data is missing first column to show aggregate fields like row 1 is Device and row 2 is Count. If possible you should refactor your five queries to get these two aggregate by and aggregate type fields. Otherwise you can just pipe the following and you should be able to pull the Count of various Devices

| transpose column_name="Count"

Re: How to merge multiple query in single output

woodcock — Wed, 29 Mar 2017 19:09:44 GMT

Add this to the end of your search:

| eval PutXAxisLableTextHere=" "
| table PutXAxisLableTextHere *

Re: How to merge multiple query in single output

twh1 — Thu, 30 Mar 2017 05:47:08 GMT

I tried the below option and got the expected result.

.....| table _time CareCredit SYPI WKS Orange Samsung

Re: How to merge multiple query in single output

niketn — Sat, 01 Apr 2017 19:51:11 GMT

@twh1... If you required time as one of the fields to be displayed you can actually use timechart or in stats add by _time clause. There is no need of an additional pipe with table. Based on your query seemed like you just needed 5 columns.

Anycase... glad you found your answer.