Splunk Search
Highlighted

How to append multiple searches in one search?

New Member

Hi,

I tried using the following command to append few searches in one:

index=network host=sg624* "fatal" NOT (Non-fatal) | timechart count as "Fatal Error" | appendcols [search  index=network host=sg624*  supervisor | timechart count as "Supervisor Card Fail" ]| appendcols [search  index=network host=sg624* "Node down" | timechart count as "Node Down"] | appendcols [search index=network host=sg624* ERR_DISABLE | timechart count as "Error Disabled Port" ]| appendcols [search index=network host=sg624* "Duplicate IP" OR IP-4-DUPADDR   | timechart count as "Duplicate IP" ] | appendcols [search index=network host=sg624* "MAC Flapping" | timechart count as "MAC Flap" ] | appendcols [search index=network host=sg624*  "Traceback" | timechart count as "Traceback Error" ] | appendcols [search index=network host=sg624* "NBRCHANGE" | timechart count as "Neighborship Change"]|eval threshold=0

But I cannot see the timestamp on the X-Axis.
When we have values for two of the above append searches we are able to see the timestamp. But if only one search is having value, the timestamp is not displayed.

Kindly suggest how can the timestamp be displayed.

Thank You.

0 Karma
Highlighted

Re: How to append multiple searches in one search?

Legend

See if this gives you better results

index=network host=sg624* ("fatal" NOT (Non-fatal)) OR ("supervisor" OR "Node down" OR ERR_DISABLE OR "Duplicate IP" OR IP-4-DUPADDR OR "MAC Flapping" OR "Traceback" OR "NBRCHANGE") 
| timechart count(match(_raw, "fatal")) as "Fatal Error" count(match(_raw, "supervisor")) as "Supervisor Card Fail" count(match(_raw, "Node Down")) as "Node Down" count(match(_raw, "ERR_DISABLE")) as "Error Disabled Port" count(match(_raw, "Duplicate IP") OR match(_raw, "IP-4-DUPADDR")) "Duplicate IP" count(match(_raw, "MAC Flapping")) as "MAC Flap" match(_raw, "Traceback")) as "Traceback Error" count(match(_raw, "NBRCHANGE")) as "Neighborship Change" 
| eval threshold=0
0 Karma
Highlighted

Re: How to append multiple searches in one search?

New Member
index=network host=sg624* ("fatal" NOT (Non-fatal)) OR ("supervisor" OR "Node down" OR ERR_DISABLE OR "Duplicate IP" OR IP-4-DUPADDR OR "MAC Flapping" OR "Traceback" OR "NBRCHANGE") | timechart count(match(_raw, "fatal")) as "Fatal Error" count(match(_raw, "supervisor")) as "Supervisor Card Fail" count(match(_raw, "Node Down")) as "Node Down" count(match(_raw, "ERR_DISABLE")) as "Error Disabled Port" count(match(_raw, ("Duplicate IP") OR match(_raw, "IP-4-DUPADDR"))) as "Duplicate IP" count(match(_raw, "MAC Flapping")) as "MAC Flap" count(match(_raw,"Traceback")) as "Traceback Error" count(match(_raw, "NBRCHANGE")) as "Neighborship Change"| eval threshold=0

This gives all values 0 (Blank Graph). But we have some Traceback Values.

0 Karma
Highlighted

Re: How to append multiple searches in one search?

New Member

The above one did not work. Any new suggestions?

0 Karma