Splunk Search

How to club and display the results of two queries in a single dashboard

Engager

Hi i am having two search queries with a difference of only the time range. I want to show the results of both the queries in a single dashboard. I s there a way to do it

Labels (1)
Tags (3)
0 Karma
1 Solution

Super Champion

Ideally splunk has created two fields - date_month and date_year. If these fields are present then you can use below stats command-

...| stats count by date_month, date_year

View solution in original post

Engager

The solution provided worked out

0 Karma

Super Champion

Ideally splunk has created two fields - date_month and date_year. If these fields are present then you can use below stats command-

...| stats count by date_month, date_year

View solution in original post

Super Champion

@sudeep5689, I am converting my comment as Answer. Please accept this if it helps.

0 Karma

Super Champion

You can create two separate panel and run each panel query on separate timerange in single dashboard.

0 Karma

Engager

i want the results in same panel

0 Karma

Super Champion

you can use earliest and latest within your query to run on separate timerange like below example-

index=abc earliest=-1d@d latest=now() |<your calculation>|append [search index=abc earliest=-5d@d latest=now()]
0 Karma

Engager

Ok
Can we show the results as separate rows using this combined search. i mean month wise

0 Karma

Engager

like count of events i need to show on a monthly basis

0 Karma

Super Champion

you can show count on a monthly basis using single query . Is there any other reason for running two query?

0 Karma

Engager

in a single query using append right or anyother way you are hinting at

0 Karma

Engager

yes need to show comparison across months for count basis.

0 Karma