Reporting

How to combine multiple reports?

suchi01
New Member

Hello Splunkers,

I have a scenario in which I have generated two reports - 1) First one shows data for last 6 months, visualized as a line chart (Data is:- count of total movie releases and total hit movies )
2) Second shows data of last for last 6 month, visualized as line chart (data is :- count of Hindi movies , English movies, Telugu movies)

Is it possible to combine these two reports?
If yes please guide me how this could be done.

0 Karma

to4kawa
Ultra Champion

Sample:

| gentimes start=01/01/2019
| eval _time=starttime
| timechart span=1month count
| eval total_movie_releases=random() % 100 + count ,hit_movies=random() % 10 + count
| sort 6 - _time
| fields - count
`comment("this is your first query sample")`
| append [| gentimes start=01/01/2019
| eval _time=starttime
| timechart span=1month count
| eval Hindi_movies=random() % 50 + count , English_movies=random() % 40 + count , Telugu_movies=random() % 10 + count 
| sort 6 - _time
| fields - count]
`comment("this is your second query sample")`
`comment("from here, the logic")`
| selfjoin _time

Recommend:

your_first_query
| append [ search your_second_query ]
| selfjoin _time

Hi, @suchi01
I don't know your query details. This works.
But it's slow, maybe.

0 Karma

DalJeanis
Legend

You can start with something like this...

Your search that finds all of each movie 
| eval TotalCount=1
| eval HitCount=if (this is a hit,1,0)
| eval HindiCount= if (this is Hindi,1,0)
| eval TeluguCount= if (this is Telugu,1,0)
| eval EnglishCount= if (this is English,1,0)
| timechart sum(*Count) as *Count
| rename *Count as *
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to combine reports. Please share your queries so we can offer solutions.

---
If this reply helps you, Karma would be appreciated.
0 Karma

suchi01
New Member

I have 2 reports :-

1) First report represents data of hit and flop movies for last 1 month in pie-chart.

2) Second report represents data of hindi hit/flop, english hit/flop, telugu hit/flop.

I need to combine these 2 reports and get all data displayed in one screen. i.e. I need one pie chart showing total hit and flop movies and other 3 pie charts showing hindi hit/flop, english hit/flop, telugu hit/flop.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...