Splunk Search

How come my trendline is not displaying on a single visualization?

jaj
Path Finder

How can I get trendline data to show up on a single visualization using the following query? The results come back fine as timechart count, but the panel won't display:

index=ui_logs source="*.logs*" | search ("Start Transaction" "status=COMPLETE")  OR ("Start Transaction" AND "status=FAILED") |
stats count(eval(searchmatch("Start Transaction") AND searchmatch("status=COMPLETE"))) as successCount 
      count(eval(searchmatch("Start Transaction") AND searchmatch("status=FAILED"))) as errorCount |
eval totalCount = successCount + errorCount |
timechart count as totalCount

I would like to map the results to a single trendline display as such:
alt text

0 Karma
1 Solution

niketn
Legend

@jaj your command with stats is removing _time field which is required by timechart

index=ui_logs source="*.logs*" search ("Start Transaction" "status=COMPLETE")  OR ("Start Transaction" AND "status=FAILED") 
| timechart count(eval(searchmatch("Start Transaction") AND searchmatch("status=COMPLETE"))) as successCount 
       count(eval(searchmatch("Start Transaction") AND searchmatch("status=FAILED"))) as errorCount 
| eval totalCount = successCount + errorCount 
| table _time totalCount

As stated in one of my precious answers, you can directly use the following after your base search:

  | timechart count as totalCount

PS: move your | search ... to the base search as in answer above since the SPL in your question is asking for all the results from index and then filtering required data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@jaj your command with stats is removing _time field which is required by timechart

index=ui_logs source="*.logs*" search ("Start Transaction" "status=COMPLETE")  OR ("Start Transaction" AND "status=FAILED") 
| timechart count(eval(searchmatch("Start Transaction") AND searchmatch("status=COMPLETE"))) as successCount 
       count(eval(searchmatch("Start Transaction") AND searchmatch("status=FAILED"))) as errorCount 
| eval totalCount = successCount + errorCount 
| table _time totalCount

As stated in one of my precious answers, you can directly use the following after your base search:

  | timechart count as totalCount

PS: move your | search ... to the base search as in answer above since the SPL in your question is asking for all the results from index and then filtering required data.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

jaj
Path Finder

@niketnilay thank you again!

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...