HI Team,
I would like to create a table in a dashboard from two difference results.
Eg: Blue stack results and Green stack results has to display on a same table like below.
Green /t Blue
Service Call_count Service Call_count
H,
Do you have any specific requirements?
If not, please check on the join and append options.
https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Join
https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Append
https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/JoinCommandUsage
Please try and let us know!!
index = avb source = "blue | stats count by Service, Call_count
index = avb source = "Green | stats count by Service, Call_count
Is it possible to display both results in same table, as Header Green / Blue and next line header as Service / Call_count
Hi,
Please check whether the below snippet is what you are looking for.
index=avb source="blue"
|eval Blue_Green="Blue"
|stats count as "Service_Call Count" by Service, Call_count ,Blue_Green
|append [ search index=avb source="Green"
|eval Blue_Green="Green"
|stats count as "Service_Call Count" by Service, Call_count,Blue_Green]
|fields - Service,Call_count
H,
Do you have any specific requirements?
If not, please check on the join and append options.
https://docs.splunk.com/Documentation/SplunkCloud/8.0.0/SearchReference/Join
https://docs.splunk.com/Documentation/Splunk/8.0.0/SearchReference/Append
https://docs.splunk.com/Documentation/SplunkInvestigate/Current/SearchReference/JoinCommandUsage
Please try and let us know!!