Dashboards & Visualizations

How can I combine these 3 queries

mukeshchandak
Engager

How can I combine these 3 queries given everything before pipe is same:

query1: index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*|timechart span=1m count

 query2: index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*|stats count(response_code) by response_code

query3:index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*| stats avg(response_time) as "Avg Response Time" max(response_time) as "Max Response Time" p99(response_time) as "99 Percentile" p95(response_time) as "95 Percentile"

Labels (2)
0 Karma

gcusello
Esteemed Legend

Hi @mukeshchandak,

what do you mean with "combine"?

do you want to use each search in a different panel of a dashboard?

or do you want to have one complessive search?

in the first case you can use the Post Process Search (you can find examples in the Splunk Dashboard Examples App), in other words, execute one time the main search and in each panel use the second part of search.

In the second case, it's difficult to merge two stats and a timechart; if you have three stats, with the same fields you could use the "append" command.

Ciao.

Giuseppe

0 Karma

mukeshchandak
Engager

Hi @gcusello  I wish to get a query out of these 3 queries which returns only relavant data(timechart span=1s count, stats count(response_code) by response_code, and stats avg(response_time) as "Avg Response Time" max(response_time) as "Max Response Time" p99(response_time) as "99 Percentile" p95(response_time) as "95 Percentile")

so that I can create summary index.

 

0 Karma

gcusello
Esteemed Legend

Hi @mukeshchandak,

for a summary index it's easier to use three searches not one!

anyway, if you want one search you have to modify the three searches giving to each one common fields, e.g. timestamp, value and response code, something like this (I don't know if is exactly what you want, but see my approach:

index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*
| bin span=1m _time 
| stats avg(response_time) as "Avg Response Time" max(response_time) as "Max Response Time" p99(response_time) as "99 Percentile" p95(response_time) as "95 Percentile" BY _time
| append [ search 
     index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*
     | bin span=1m _time
     | stats earliest(_time) AS _time count(response_code) As "Count Response Time" by response_code ]
| append [ search 
     index=abc source="*/d/e/f.log" artifact_id=g*h*i* host!=“jkl*” cloud=mno consumer_id=* response_code=*
     | stats earliest(_time) AS _time avg(response_time) as "Avg Response Time" max(response_time) as "Max Response Time" p99(response_time) as "99 Percentile" p95(response_time) as "95 Percentile" ]

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...