Splunk Search

How to combine two different search results in a single visualization?

kenvanderheyden
Path Finder

Hello,

I'm having trouble combining two different search results, from different source type into one visualization.

These are the two search strings:

index=* sourcetype=typeA| stats count by date_year | eventstats avg(count) | rename count as "total", avg(count) as "global average"
index=* sourcetype=otherTypeB| stats count by date_year | eventstats avg(count) | rename count as "total", avg(count) as "global average"

Both searches result in a line.
I would like to see both in one visualization, so the correlation between the events if there is one, becomes visible.

Tried using a join:

index=* sourcetype=typeA| join date_year [search sourcetype=otherTypeB] | stats count by date_year | eventstats avg(count)

But this results in having a single line.
Not sure how to proceed from here on.

Regards,
Ken.

0 Karma
1 Solution

kenvanderheyden
Path Finder

Found a simple solution:

index=* sourcetype=type1 OR sourcetype=otherTypeB
| timechart count(eval(sourcetype=="type1")) , count(eval(sourcetype=="otherTypeB")) 

View solution in original post

0 Karma

kenvanderheyden
Path Finder

Found a simple solution:

index=* sourcetype=type1 OR sourcetype=otherTypeB
| timechart count(eval(sourcetype=="type1")) , count(eval(sourcetype=="otherTypeB")) 

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!