Reporting

i have 2 searches having same sourcetype but different string parameter results, how can i combine those and it should result in one by one in stats

ramanir
New Member

I have 2 searches separately, how can i combine those to fetch results one by one in statistics tab.like mentioned below.

siebel-order-details 1/7/2019 12:55 10

pinless-product-offers 1/7/2019 12:00 19

index=vha_pronto
sourcetype=pronto_pil_logs
"pinless-product-offers" earliest=-1h@h latest=-0h@h |
timechart count as "Total Request" span=5m

index=vha_pronto
sourcetype=pronto_pil_logs
"siebel-order-details" earliest=-1h@h latest=-0h@h |
timechart count as "Total Request" span=5m

Tags (1)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can combine the two like this:

earliest=-1h@h latest=-0h@h index=vha_pronto sourcetype=pronto_pil_logs ("pinless-product-offers" OR "siebel-order-details")
| eval class = case(searchmatch("pinless-product-offers"), "pinless", searchmatch("siebel-order-details"), "siebel", true(), "wtf")
| timechart span=5m count by class

This will search for both types of events, classify them [priority given to pinless here, in case an event contains both strings], and count each class of events over time, giving you two value columns / coloured lines in your chart.

Relying on just strings contained in your event is often okay, but I recommend using a field that contains the type of product offer you are looking for, and splitting the timechart by that field. Then you won't have to re-classify manually in every search. If you had such a field the search would look like this:

earliest=-1h@h latest=-0h@h index=vha_pronto sourcetype=pronto_pil_logs (product_category="pinless-product-offers" OR product_category="siebel-order-details")
| timechart span=5m count by product_category
0 Karma

p_gurav
Champion

Try append command:

index=vha_pronto 
sourcetype=pronto_pil_logs
"pinless-product-offers" earliest=-1h@h latest=-0h@h |
timechart count as "Total Request" span=5m | append [ search index=vha_pronto 
sourcetype=pronto_pil_logs
"siebel-order-details" earliest=-1h@h latest=-0h@h | 
timechart count as "Total Request" span=5m ]
0 Karma

ramanir
New Member

@p_gurav
thanks for you reply but iam not getting exact output when i use append.

query 1:

index=vha_pronto sourcetype=pronto_pil_logs "pinless-product-offers" earliest=-1h@h latest=-0h@h | timechart count as "Total Request" span=5m |appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "updateProntoProdOffers" earliest=-1h@h latest=-0h@h | timechart count as "Total Success" span=5m] | appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "pinless-product-offers" AND "The system is temporarily unavailable" earliest=-1h@h latest=-0h@h | timechart count as "Total failure" span=5m] | eval instanceName="Pinless_SS2_Order" | eval Time=strftime(time,"%Y-%m-%d %H:%M") | eval Platform="Pronto" | eval Application="PIL"| eval instanceTag=instanceName."".Platform."_".Application |table instanceTag Platform Application Time "Total Request" "Total Success" "Total failure" | rename instanceTag AS "#Instance TAG" Time as Timestamp |fillnull

query 2:

index=vha_pronto sourcetype=pronto_pil_logs "siebel-order-details" earliest=-1h@h latest=-0h@h | timechart count as "Total Request" span=5m ] |appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "updateProntoSiebelOrder" earliest=-1h@h latest=-0h@h | timechart count as "Total Success" span=5m] | appendcols [search index=vha_pronto sourcetype=pronto_pil_logs "siebel-order-details" AND "The system is temporarily unavailable" earliest=-1h@h latest=-0h@h | timechart count as "Total failure" span=5m] | eval instanceName="Siebel_VFF_Order_SS2_Order" | eval Time=strftime(time,"%Y-%m-%d %H:%M") | eval Platform="Pronto" | eval Application="PIL"| eval instanceTag=instanceName."".Platform."_".Application |table instanceTag Platform Application Time "Total Request" "Total Success" "Total failure" | rename instanceTag AS "#Instance TAG" Time as Timestamp |fillnull

how can i combine these 2 to produce result as one by one like below:
Siebel_VFF_Order_Pronto_PIL Pronto PIL 1/7/2019 12:55 10 10 0
Pinless_SS2_Order_Pronto_PIL Pronto PIL 1/7/2019 12:00 19 19 0

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...