Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to compute the value of 2 different complex qu...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok, so I want to see the ratio between "interview.completed" and "interview.started", but filtering each event by unique interviewCode
Currently, each separate search looks like this:
Search for unique interviews started:
source="http:Tracker" | spath "message.environment" | search "message.environment"=production | spath eventName | search eventName="pre-record.candidate.interview.start" | spath interviewCode | search interviewCode=* | dedup interviewCode | timechart span=1w count by eventName
Result 6
Search for unique interviews completed:
source="http:Tracker" | spath "message.environment" | search "message.environment"=production | spath eventName | search eventName="pre-record.candidate.interview.completed" | spath interviewCode | search interviewCode=* | dedup interviewCode | timechart span=1w count by eventName
Result 1
How can I create a chart that displays both values side by side?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
source="http:Tracker" | spath "message.environment" | search "message.environment"=production | spath eventName | search eventName="pre-record.candidate.interview.start" OR eventName="pre-record.candidate.interview.completed"| spath interviewCode | search interviewCode=* | dedup eventName interviewCode | timechart span=1w count by eventName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
source="http:Tracker" | spath "message.environment" | search "message.environment"=production | spath eventName | search eventName="pre-record.candidate.interview.start" OR eventName="pre-record.candidate.interview.completed"| spath interviewCode | search interviewCode=* | dedup eventName interviewCode | timechart span=1w count by eventName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It looks like you might be able to just take where you do
... | search eventName="pre-record.candidate.interview.start"
and
... | search eventName="pre-record.candidate.interview.completed"
And combine them into one where you search for either.
... | search eventName="pre-record.candidate.interview.start" OR eventName="pre-record.candidate.interview.start
That should get you both on one set of results.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Rich, thanks for your reply.
I have tried using "OR" but the result of that query is only one number and what I want is a chart where I can see both numbers:
Interviews started by unique interviewCode = 6
Interview completed by unique interviewCode = 1
Meaning my completion rate is 1/6 = 16%
Building Reliable Asset and Identity Frameworks in Splunk ES
Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting
Automatic Discovery Part 3: Practical Use Cases
