Splunk Search

How to append multiple searches in one search?

anujs
New Member

Hi,

I tried using the following command to append few searches in one:

index=network host=sg624* "fatal" NOT (Non-fatal) | timechart count as "Fatal Error" | appendcols [search  index=network host=sg624*  supervisor | timechart count as "Supervisor Card Fail" ]| appendcols [search  index=network host=sg624* "Node down" | timechart count as "Node Down"] | appendcols [search index=network host=sg624* ERR_DISABLE | timechart count as "Error Disabled Port" ]| appendcols [search index=network host=sg624* "Duplicate IP" OR IP-4-DUPADDR   | timechart count as "Duplicate IP" ] | appendcols [search index=network host=sg624* "MAC Flapping" | timechart count as "MAC Flap" ] | appendcols [search index=network host=sg624*  "Traceback" | timechart count as "Traceback Error" ] | appendcols [search index=network host=sg624* "NBRCHANGE" | timechart count as "Neighborship Change"]|eval threshold=0

But I cannot see the timestamp on the X-Axis.
When we have values for two of the above append searches we are able to see the timestamp. But if only one search is having value, the timestamp is not displayed.

Kindly suggest how can the timestamp be displayed.

Thank You.

0 Karma

sundareshr
Legend

See if this gives you better results

index=network host=sg624* ("fatal" NOT (Non-fatal)) OR ("supervisor" OR "Node down" OR ERR_DISABLE OR "Duplicate IP" OR IP-4-DUPADDR OR "MAC Flapping" OR "Traceback" OR "NBRCHANGE") 
| timechart count(match(_raw, "fatal")) as "Fatal Error" count(match(_raw, "supervisor")) as "Supervisor Card Fail" count(match(_raw, "Node Down")) as "Node Down" count(match(_raw, "ERR_DISABLE")) as "Error Disabled Port" count(match(_raw, "Duplicate IP") OR match(_raw, "IP-4-DUPADDR")) "Duplicate IP" count(match(_raw, "MAC Flapping")) as "MAC Flap" match(_raw, "Traceback")) as "Traceback Error" count(match(_raw, "NBRCHANGE")) as "Neighborship Change" 
| eval threshold=0
0 Karma

anujs
New Member
index=network host=sg624* ("fatal" NOT (Non-fatal)) OR ("supervisor" OR "Node down" OR ERR_DISABLE OR "Duplicate IP" OR IP-4-DUPADDR OR "MAC Flapping" OR "Traceback" OR "NBRCHANGE") | timechart count(match(_raw, "fatal")) as "Fatal Error" count(match(_raw, "supervisor")) as "Supervisor Card Fail" count(match(_raw, "Node Down")) as "Node Down" count(match(_raw, "ERR_DISABLE")) as "Error Disabled Port" count(match(_raw, ("Duplicate IP") OR match(_raw, "IP-4-DUPADDR"))) as "Duplicate IP" count(match(_raw, "MAC Flapping")) as "MAC Flap" count(match(_raw,"Traceback")) as "Traceback Error" count(match(_raw, "NBRCHANGE")) as "Neighborship Change"| eval threshold=0

This gives all values 0 (Blank Graph). But we have some Traceback Values.

0 Karma

anujs
New Member

The above one did not work. Any new suggestions?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...