Splunk Search

Append 3 timecharts in a graph ?


I have two timecharts that I appended using appendcols. Now I have another query that I want to append as well but append cols only appends two searches? I can't use match and case because it is different fields?

earliest=-1d@d latest=@d host="NETWEBA*" sourcetype="WinEventLog:Application" AND ApplicationSource="/order*" AND "ErrorGUID" | timechart span=1h count AS "Order20" | appendcols [search earliest=-1d@d latest=@d host="NETAPPA*" sourcetype="WinEventLog:Application" AND AppDomainName= EcomSubscription.* AND "ErrorGUID" | timechart span=1h count AS "EcomSubscription" ]

Query I'm trying to insert:

  host=NETAPPA* AND LogName=Application AND Monster.Services.Windows.ServiceBase. AND Message="MonsterWindowsService" sourcetype="WinEventLog:Application"
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...