Splunk Search

How to execute the search query on different source file an dynamic values for yaxis

deepthi5
Path Finder

Hi team,

I am stucked up with few search commands can some one pls help me
I am using the same search command on different source files using append cols but my problem is like this

I h ave a combo box which select Tier1,Tier 2,Tier3

source="C:\Network Analysis\tier1\rusxwalmartedc S0-0-0.csv" sourcetype="csv" |rex field=source "(?<country>.?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename tier|search tier=tier3|where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=In/1048576|bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time |eval total=Percentile/maxin*100|timechart span=1d values(total) As walmarttotal(%)|appendcols[search source="C:\Network Analysis\tier2\rdingurgao010-5-1 f0-1.csv" sourcetype="csv" |rex field=source "(?<country>.?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename tier|search tier=tier3 |where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=In/1048576|bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time |eval total=Percentile/maxin*100|timechart span=1d values(total) As gurgoantotal(%)]

Even though the first main search criteria is not fullfilled still the first search query result is displayed in every chart

alt text

this command is going bigger and bigger as i add other sites command so i changed the command using OR

source="C:\Network Analysis\tier1\rusxwalmartedc S0-0-0.csv" OR source="C:\Network Analysis\tier2\rdingurgao010-5-1 f0-1.csv sourcetype="csv" |rex field=source "(?<country>.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename tier|search tier=tier3|where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=In/1048576|bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by _time |eval total=Percentile/maxin*100|timechart span=1d values(total) As walmarttotal(%)

but at the last i want to come sitename as the yaxis label for different sites an example walmart total, gurgoan total%

Thanks and Regards,
Deepthi

Tags (2)
0 Karma

woodcock
Esteemed Legend

I am having great trouble understanding so this is a guess but try this:

source="C:Network Analysistier1rusxwalmartedc S0-0-0.csv" OR source="C:Network Analysistier2rdingurgao010-5-1 f0-1.csv sourcetype="csv" |rex field=source "(?<country>.*?)$"| lookup datacentre.csv country OUTPUT start_hour end_hour receivebandwidth sitename tier|search tier=tier3|where date_hour>=start_hour AND date_hour<= end_hour|eval Intraffic=In/1048576|bin _time span=1d| stats values(receivebandwidth) as maxin ,perc95(Intraffic) AS Percentile by sitename _time |eval total=Percentile/maxin*100|timechart span=1d avg(total) As siteTotalPct by sitename
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...