Dashboards & Visualizations

How can I combine these 3 queries

mukeshchandak
Engager

How can I combine these 3 queries given everything before pipe is same:

query1: index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*|timechart span=1m count

 query2: index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*|stats count(response_code) by response_code

query3:index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*| stats avg(response_time) as "Avg Response Time" max(response_time) as "Max Response Time" p99(response_time) as "99 Percentile" p95(response_time) as "95 Percentile"

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mukeshchandak,

what do you mean with "combine"?

do you want to use each search in a different panel of a dashboard?

or do you want to have one complessive search?

in the first case you can use the Post Process Search (you can find examples in the Splunk Dashboard Examples App), in other words, execute one time the main search and in each panel use the second part of search.

In the second case, it's difficult to merge two stats and a timechart; if you have three stats, with the same fields you could use the "append" command.

Ciao.

Giuseppe

0 Karma

mukeshchandak
Engager

Hi @gcusello  I wish to get a query out of these 3 queries which returns only relavant data(timechart span=1s count, stats count(response_code) by response_code, and stats avg(response_time) as "Avg Response Time" max(response_time) as "Max Response Time" p99(response_time) as "99 Percentile" p95(response_time) as "95 Percentile")

so that I can create summary index.

 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mukeshchandak,

for a summary index it's easier to use three searches not one!

anyway, if you want one search you have to modify the three searches giving to each one common fields, e.g. timestamp, value and response code, something like this (I don't know if is exactly what you want, but see my approach:

index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*
| bin span=1m _time 
| stats avg(response_time) as "Avg Response Time" max(response_time) as "Max Response Time" p99(response_time) as "99 Percentile" p95(response_time) as "95 Percentile" BY _time
| append [ search 
     index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*
     | bin span=1m _time
     | stats earliest(_time) AS _time count(response_code) As "Count Response Time" by response_code ]
| append [ search 
     index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*
     | stats earliest(_time) AS _time avg(response_time) as "Avg Response Time" max(response_time) as "Max Response Time" p99(response_time) as "99 Percentile" p95(response_time) as "95 Percentile" ]

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...