Splunk Search

How can I combine two chart query outputs as 1?

reetesh121
New Member

Part A:

index=web splunk_server_group=hotel sourcetype=hotellog eventname=hotel-book earliest=-3d| eval dateyearweek = strftime(_time, "%Y-%U")| stats count(eval(like(success,"false"))) as F, count(eval(like(success,"true"))) as S by sitename, dateyearweek | eval P=((S*100)/(S+F))| chart values(P) over sitename by dateyearweek

Part B:

index=web splunk_server_group=hotel sourcetype=hotellog eventname=hotel-book earliest=-3d| eval weeknumber= strftime(_time, "%Y-%U")| chart count by sitename, weeknumber

Requirement: I want to combine both outputs as 1 search query.

Tags (1)
0 Karma

horsefez
Motivator

I'm not sure if that is actually what you want, but I will still annotate it.

Have you heard about the | append command before?
You could append the results of the second search to the first search results.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...