Splunk Search
Highlighted

How to combine the results of my two searches in one graph?

Communicator

I have these two simple searches and I would like to combine them on one graph to display both "passed" and "failed" data. What is the most efficient way to do that? I would like to take this as an example for my future use.

index=all-mac host=eng* "unkown MAC" OR "No MAC " OR "mismatch MAC" | timechart count as Failed span=1d

and

index=al-mac host=eng* "match for MAC" | timechart count as Passed span=1d
Tags (3)
Highlighted

Re: How to combine the results of my two searches in one graph?

Influencer

Something like this should do..


index=all-mac host=eng* | eval STATUS= if(searchmatch("unkown MAC"), "Failed", (if(searchmatch("No MAC"),"Failed", if(searchmatch("No MAC"), "Failed", if(searchmatch("match for MAC"), "Passed","OTHER"))))) | timechart span=1d count by STATUS

View solution in original post

Highlighted

Re: How to combine the results of my two searches in one graph?

Communicator

thanks much for your response! do you mind if you can tell me how "Passed" evaluate? the search key for passed is "match for MAC" so i am curious about that.

0 Karma
Highlighted

Re: How to combine the results of my two searches in one graph?

Influencer

I've edited my answer to consider "match for MAC" explicitly for "Passed"

0 Karma
Highlighted

Re: How to combine the results of my two searches in one graph?

Communicator

thanks, it's working perfectly. something try to remove is "OTHER" is that must be there to work. i am only need Failed and Passed on my graph.

0 Karma
Highlighted

Re: How to combine the results of my two searches in one graph?

Influencer

like @somesoni2 suggested, you can prefilter the data within your base search by adding

"unkown MAC" OR "No MAC " OR "mismatch MAC" OR "match for MAC"
or you can also do
STATUS!="OTHER" just before your timechart

0 Karma
Highlighted

Re: How to combine the results of my two searches in one graph?

SplunkTrust
SplunkTrust

Give this one a try which will not yield the "OTHERs"

index=all-mac host=eng* "unkown MAC" OR "No MAC " OR "mismatch MAC" OR "match for MAC" | eval STATUS= if(searchmatch("match for MAC"), "Passed", "Failed") | timechart span=1d count by STATUS

Basically, base search itself filters unwanted events and this makes the STATUS calculation also simple.

Highlighted

Re: How to combine the results of my two searches in one graph?

Communicator

thanks much, work as expected.

0 Karma
Highlighted

Re: How to combine the results of my two searches in one graph?

Path Finder

If you want to compare times, week over week for example, in your timeline there is a great app that helps with that, timewrap.

https://apps.splunk.com/app/1645/