Splunk Enterprise

How to combine two search queries where one query has to use a filter option?

priyaramki16
Path Finder

I have a search query as

sourcetype="file.csv"|eval Created_Date = mvindex(split(Created," "),0)| stats count as Issues_created by Created_Date

which gives me output as 

priyaramki16_0-1592372188607.png

Similarly another search query as 

sourcetype="file.csv" Resolved|eval Created_Date = mvindex(split(Created," "),0)|stats count as Issues_Resolved by Created_Date

basically i am filtering out events which have status as Resolved and creating  events

which gives me output as 

priyaramki16_1-1592372379128.png

I want to combine these two queris to give me bar chart which will display the statistics as

Created_Date ---- Issues_created ---- Issues_Resolved

01-01-202088
01-02-202090
01-03-202061

 

Kindly help me with this..

Labels (1)
Tags (3)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...