Splunk Search

How to build a timechart from a combined search

brajaram
Communicator

I have two different sources, each with information related to one another. The first source has, as part of the file, every successful page hit. The second source, has, as part of the file, every error report.

index= sourcetype=< st> source= < hit log > < some further conditions >
| stats count as total_hits 
| appendcols [search index= sourcetype=< st> source= < error log > < some otherfurther conditions > 
| stats count as total_errors ]

If I do a search like this, I successfully get the count of crashes, count of successes, and can do an eval FailureRate= total_hits/total_errors

However, I want to further do a timechart to see the failure rate over time, and this is where I am stuck. How would I propagate time throughout this process to build a timechart of a single value?

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (I'm assuming sourcetype is the only distinction between two sources. If sourcetype is same and source is different, update if condition with that)
Updated

(index= sourcetype=< st> source= < hit log > < some further conditions >) OR ( index= sourcetype=< st> source= < error log > < some otherfurther conditions >)
| eval type=if(source="< hit log > ","total_hits","total_errors")
| timechart count by type | eval FailureRate= total_hits/total_errors

View solution in original post

somesoni2
Revered Legend

Try like this (I'm assuming sourcetype is the only distinction between two sources. If sourcetype is same and source is different, update if condition with that)
Updated

(index= sourcetype=< st> source= < hit log > < some further conditions >) OR ( index= sourcetype=< st> source= < error log > < some otherfurther conditions >)
| eval type=if(source="< hit log > ","total_hits","total_errors")
| timechart count by type | eval FailureRate= total_hits/total_errors

brajaram
Communicator

Worked great, thanks! A different approach than I had, and it worked to keep the time field all the way down.

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! &#x1f44f; Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...