Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- Trendline on column chart
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi I want to combine two searches ,they are as below.
search 1: source="------" X_STATUS="Ended" ID_map!=" " | table ID_map,OBJID,X_COMMITTED_START_DATE,X_COMMITTED_END_DATE | eval j2=X_COMMITTED_END_DATE
| eval j1=X_COMMITTED_START_DATE
| eval d1=strptime(j1,"%d-%b-%y")
| eval d2=strptime(j2,"%d-%b-%y")
| eval diff = (d2-d1)/86400 | rename OBJID as CONTRACTID | rename ID_map as TASK_NUMBER | join TASK_NUMBER [search source="CLASSIC_TASK_NAMES1.csv"] | table TASK_GROUP,CONTRACTID,diff,FILED_ENGG_NAME | stats sum(diff) as Total,count(CONTRACTID) as Number by FILED_ENGG_NAME | eval Average=round(Total/Number,2) | rename FILED_ENGG_NAME as "FIELD ENGG NAME" | rename Average as "Average Time Taken per Order" | table "FIELD ENGG NAME","Average Time Taken per Order".
which displays in column chart as average time taken by each field engineers to complete the order.
search 2: source="------" X_STATUS="Ended" ID_map!=" " | table ID_map,OBJID,X_COMMITTED_START_DATE,X_COMMITTED_END_DATE | eval j2=X_COMMITTED_END_DATE
| eval j1=X_COMMITTED_START_DATE
| eval d1=strptime(j1,"%d-%b-%y")
| eval d2=strptime(j2,"%d-%b-%y")
| eval diff = (d2-d1)/86400 | rename OBJID as CONTRACTID | rename ID_map as TASK_NUMBER | join TASK_NUMBER [search source="CLASSIC_TASK_NAMES1.csv"] | table TASK_GROUP,CONTRACTID,diff,FILED_ENGG_NAME | stats sum(diff) as Total,count(CONTRACTID) as no by FILED_ENGG_NAME| eval avgEngi=(Total/no) | stats sum(avgEngi) as avg,count(FILED_ENGG_NAME) as cnt by FILED_ENGG_NAME | eval ThresholdClosedTime=round(avg/cnt,2) | table FILED_ENGG_NAME,ThresholdClosedTime | chart avg(ThresholdClosedTime) by FILED_ENGG_NAME | trendline ema2(avg(ThresholdClosedTime))
which gives the trend of threshold closed time.
I want to combine two searches and display the results in one chart with search1 being the column chart and search2 being the trendline on column chart.
please help me on modules and parameters to get the same and also let me know whether queries are correct.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
