Splunk Search

How to combine my two searches into one bar graph?

JoshuaJohn
Contributor

I scoured the internet, but came along a few different attempts and I tried, but the results were not what I was looking for.

Here are my searches:
1)

index=nitro_prod_pci_expenses "Calling translate" earliest=-1d@d latest=now | stats count as OrderCount

2)

index="nitro_prod_pci_email" INFO EmailType=Order_Confirmation earliest=-1d@d | stats count as OrderCount

I tried using appencols, but the result ended up being "1" or a different time showed both respective search results, but when I tried to visualize it into a piechart, one would completely overlay the other one, and when I tried with a bar graph, it would just be one large square.

Any Ideas?

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

(index=nitro_prod_pci_expenses "Calling translate") OR ( index="nitro_prod_pci_email" INFO EmailType=Order_Confirmation ) | stats count by index | replace nitro_prod_pci_expenses with ExpenseOrderCount nitro_prod_pci_email with ConfirmationOrderCount

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

(index=nitro_prod_pci_expenses "Calling translate") OR ( index="nitro_prod_pci_email" INFO EmailType=Order_Confirmation ) | stats count by index | replace nitro_prod_pci_expenses with ExpenseOrderCount nitro_prod_pci_email with ConfirmationOrderCount
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Synthetic Monitoring - Resolved Incident on Detector Alerts

We’ve discovered a bug that affected the auto-clear of Synthetic Detectors in the Splunk Synthetic Monitoring ...

Video | Tom’s Smartness Journey Continues

Remember Splunk Community member Tom Kopchak? If you caught the first episode of our Smartness interview ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud? Learn how unique features like ...