Splunk Search

How to append two columns from different data inputs based on time

pahujadeep
Explorer

I have data in below format 

Data Input 1 :  index=abc

Time (YYYY-MM-DD HH24)Count1
2020-09-30 0010
2020-09-30 0120
2020-09-30 02 40

 

Data Input 2 : index=xyz

Time (YYYY-MM-DD HH24)Count2
2020-09-30 0030
2020-09-30 0110
2020-09-30 02 25

 

I am looking for output like this :

Time (YYYY-MM-DD HH24)Count1Count2
2020-09-30 001030
2020-09-30 012010
2020-09-30 024025

 

And create a timechart out of this for both values

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=abc OR index=xyz
| stats values(Count1) as Count1 values(Count2) as Count2 by _time

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
index=abc OR index=xyz
| stats values(Count1) as Count1 values(Count2) as Count2 by _time
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...