Splunk Search

How to add two different chart queries and get the results in single table

rkishoreqa
Communicator

I have two queries like as below : 

> index="int_audit_dev" | chart count(ApplicationName) over ApplicationName by Status

> index="int_audit_dev" | chart count(event.ApplicationName) over event.ApplicationName by event.Status

Individually these two queries are fine and able to get the data in tabular format. But I want the data as a sum of values in tabular format.

Any suggestions?

Labels (1)
0 Karma

rkishoreqa
Communicator

I want to add the results of below two queries

> index="int_audit_dev" | chart count(ApplicationName) over ApplicationName by Status |addtotals
> index="int_audit_dev" | chart count(event.ApplicationName) over event.ApplicationName by event.Status |addtotals

0 Karma

to4kawa
Ultra Champion

index="int_audit_dev" |eval status=coalesce(Status,event.Status), applicationName=coalesce(ApplicationName,event.ApplicationName)| chart count(applicationName) over applicationName by status

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you provide an example of what you currently have and what you would like

0 Karma

rkishoreqa
Communicator

I want to add the results of below two queries

index="int_audit_dev" | chart count(ApplicationName) over ApplicationName by Status |addtotals index="int_audit_dev" | chart count(event.ApplicationName) over event.ApplicationName by event.Status |addtotals

0 Karma

rkishoreqa
Communicator

Example :
query 1 : index="int_audit_dev" | chart count(ApplicationName) over ApplicationName by Status |addtotals 
for the above query, I am getting as below
a    5
b    8

query 2 : index="int_audit_dev" | chart count(event.ApplicationName) over event.ApplicationName by event.Status |addtotals
for this query, the results will be like
a    3
b    6

Now I need a single query to add above both values and display in Dashboard like below (adding above both table data):
a      8
b    14

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...