Splunk Search

How to combine the results of my two searches in one graph?

raindrop18
Communicator

I have these two simple searches and I would like to combine them on one graph to display both "passed" and "failed" data. What is the most efficient way to do that? I would like to take this as an example for my future use.

index=all-mac host=eng* "unkown MAC" OR "No MAC " OR "mismatch MAC" | timechart count as Failed span=1d

and

index=al-mac host=eng* "match for MAC" | timechart count as Passed span=1d
Tags (3)
1 Solution

pradeepkumarg
Influencer

Something like this should do..


index=all-mac host=eng* | eval STATUS= if(searchmatch("unkown MAC"), "Failed", (if(searchmatch("No MAC"),"Failed", if(searchmatch("No MAC"), "Failed", if(searchmatch("match for MAC"), "Passed","OTHER"))))) | timechart span=1d count by STATUS

View solution in original post

trsavela
Path Finder

If you want to compare times, week over week for example, in your timeline there is a great app that helps with that, timewrap.

https://apps.splunk.com/app/1645/

pradeepkumarg
Influencer

Something like this should do..


index=all-mac host=eng* | eval STATUS= if(searchmatch("unkown MAC"), "Failed", (if(searchmatch("No MAC"),"Failed", if(searchmatch("No MAC"), "Failed", if(searchmatch("match for MAC"), "Passed","OTHER"))))) | timechart span=1d count by STATUS

raindrop18
Communicator

thanks much, work as expected.

0 Karma

raindrop18
Communicator

thanks much for your response! do you mind if you can tell me how "Passed" evaluate? the search key for passed is "match for MAC" so i am curious about that.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this one a try which will not yield the "OTHERs"

index=all-mac host=eng* "unkown MAC" OR "No MAC " OR "mismatch MAC" OR "match for MAC" | eval STATUS= if(searchmatch("match for MAC"), "Passed", "Failed") | timechart span=1d count by STATUS

Basically, base search itself filters unwanted events and this makes the STATUS calculation also simple.

pradeepkumarg
Influencer

I've edited my answer to consider "match for MAC" explicitly for "Passed"

0 Karma

raindrop18
Communicator

thanks, it's working perfectly. something try to remove is "OTHER" is that must be there to work. i am only need Failed and Passed on my graph.

0 Karma

pradeepkumarg
Influencer

like @somesoni2 suggested, you can prefilter the data within your base search by adding

"unkown MAC" OR "No MAC " OR "mismatch MAC" OR "match for MAC"
or you can also do
STATUS!="OTHER" just before your timechart

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...