Splunk Search

How to append search as new row?

Path Finder

Given the following query, how can I append the second query so that the results show up as two rows so I can graph the results (in a pie chart).

// This query appends a new search as an additional col but what I really want i a new row.
source=*/blah/the.log "labelData= " | stats count as NOMATCHES
| appendcols [search source=*/blah/the.log labelData!="" | stats count as MATCHES ]

Tags (2)
1 Solution

Splunk Employee
Splunk Employee

try the append instead of appendcols

View solution in original post

Splunk Employee
Splunk Employee

try the append instead of appendcols

View solution in original post

Path Finder

single query is exactly what I was looking for...I just what i was looking for...the labelData= was messing my query up as I couldn't query it by null or by labelData="". This worked awesome! Thanks!

0 Karma

Splunk Employee
Splunk Employee

but you could also do all in a single search with an eval or a case and define your own field.

example

source=*/blah/the.log "labelData= " OR labelData!=""
| eval label=if(isnull(labelData),"nomatch","match")
| stats count by label

SplunkTrust
SplunkTrust

just use "append" instead of "appendcols"