Splunk Search

How to build a timechart from a combined search

brajaram
Communicator

I have two different sources, each with information related to one another. The first source has, as part of the file, every successful page hit. The second source, has, as part of the file, every error report.

index= sourcetype=< st> source= < hit log > < some further conditions >
| stats count as total_hits 
| appendcols [search index= sourcetype=< st> source= < error log > < some otherfurther conditions > 
| stats count as total_errors ]

If I do a search like this, I successfully get the count of crashes, count of successes, and can do an eval FailureRate= total_hits/total_errors

However, I want to further do a timechart to see the failure rate over time, and this is where I am stuck. How would I propagate time throughout this process to build a timechart of a single value?

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this (I'm assuming sourcetype is the only distinction between two sources. If sourcetype is same and source is different, update if condition with that)
Updated

(index= sourcetype=< st> source= < hit log > < some further conditions >) OR ( index= sourcetype=< st> source= < error log > < some otherfurther conditions >)
| eval type=if(source="< hit log > ","total_hits","total_errors")
| timechart count by type | eval FailureRate= total_hits/total_errors

View solution in original post

somesoni2
Revered Legend

Try like this (I'm assuming sourcetype is the only distinction between two sources. If sourcetype is same and source is different, update if condition with that)
Updated

(index= sourcetype=< st> source= < hit log > < some further conditions >) OR ( index= sourcetype=< st> source= < error log > < some otherfurther conditions >)
| eval type=if(source="< hit log > ","total_hits","total_errors")
| timechart count by type | eval FailureRate= total_hits/total_errors

brajaram
Communicator

Worked great, thanks! A different approach than I had, and it worked to keep the time field all the way down.

0 Karma
Get Updates on the Splunk Community!

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...

Getting Started with AIOps: Event Correlation Basics and Alert Storm Detection in ...

Getting Started with AIOps:Event Correlation Basics and Alert Storm Detection in Splunk IT Service ...

Register to Attend BSides SPL 2022 - It's all Happening October 18!

Join like-minded individuals for technical sessions on everything Splunk!  This is a community-led and run ...