How to combine the results of my two searches in one graph?

[raindrop18]

I have these two simple searches and I would like to combine them on one graph to display both "passed" and "failed" data. What is the most efficient way to do that? I would like to take this as an example for my future use.

index=all-mac host=eng* "unkown MAC" OR "No MAC " OR "mismatch MAC" | timechart count as Failed span=1d

and

index=al-mac host=eng* "match for MAC" | timechart count as Passed span=1d

[trsavela]

If you want to compare times, week over week for example, in your timeline there is a great app that helps with that, timewrap.

https://apps.splunk.com/app/1645/

[pradeepkumarg · Accepted solution]

Something like this should do..

index=all-mac host=eng* | eval STATUS= if(searchmatch("unkown MAC"), "Failed", (if(searchmatch("No MAC"),"Failed", if(searchmatch("No MAC"), "Failed", if(searchmatch("match for MAC"), "Passed","OTHER"))))) | timechart span=1d count by STATUS

[raindrop18]

thanks much, work as expected.

[raindrop18]

thanks much for your response! do you mind if you can tell me how "Passed" evaluate? the search key for passed is "match for MAC" so i am curious about that.

[somesoni2]

Give this one a try which will not yield the "OTHERs"

index=all-mac host=eng* "unkown MAC" OR "No MAC " OR "mismatch MAC" OR "match for MAC" | eval STATUS= if(searchmatch("match for MAC"), "Passed", "Failed") | timechart span=1d count by STATUS

Basically, base search itself filters unwanted events and this makes the STATUS calculation also simple.

[pradeepkumarg]

I've edited my answer to consider "match for MAC" explicitly for "Passed"

[raindrop18]

thanks, it's working perfectly. something try to remove is "OTHER" is that must be there to work. i am only need Failed and Passed on my graph.

[pradeepkumarg]

like @somesoni2 suggested, you can prefilter the data within your base search by adding

"unkown MAC" OR "No MAC " OR "mismatch MAC" OR "match for MAC"

or you can also do

STATUS!="OTHER" just before your timechart