Splunk Search
Highlighted

How to generate a timechart from multiple data sources?

Explorer

I need a time chart from multiple source --

First source search : host=abcdefgh source="Test.log" index=app_ops_prod SessionID="*"
Second Source search : host=abcdefgh source="Test.log" index=app_ops_prod "error.timeout"
Third Source search : host=abcdefgh source="Test.log" index=app_ops_prod "error.badurl"

My SessionID is a field, but other two strings might be present in the raw log. In short, for one request a log line is generated which will always have a SessionID, but few log lines may contain error. I want a timechart that will show number of request (i.e. count of SessionID) and the errors in all the request.

0 Karma
Highlighted

Re: How to generate a timechart from multiple data sources?

Path Finder

Plz try that.

index=appopsprod host=abcdefgh source="Test.log" SessionID="*" | timechart span=1m count(SessionID) | appendcols [search index=appopsprod host=abcdefgh source="Test.log" ("error.badurl" OR "error.timeout") | timechart span=1m count]

Also on the chart, you can add the chart overlay to better illustrate your data.

0 Karma
Highlighted

Re: How to generate a timechart from multiple data sources?

Explorer

Not sure about this. It is not giving expected results. But, the one answer posted below seems to work fine

0 Karma
Highlighted

Re: How to generate a timechart from multiple data sources?

Path Finder

No problem 🙂 I'm glad to hear that your problem has been solved.

0 Karma
Highlighted

Re: How to generate a timechart from multiple data sources?

SplunkTrust
SplunkTrust

Try like this

host=abcdefgh source="Test.log" index=app_ops_prod (SessionID="*" OR "error.timeout" OR  "error.badurl" )
| eval TimeoutError=if(searchmatch("error.timeout"),1,0) | eval BadUrlError=if(searchmatch("error.badurl"),1,0) 
| timechart count(SessionID) as NoOfRequests sum(TimeoutError) as TimeoutError sum(BadUrlError) as BadUrlError

View solution in original post

Highlighted

Re: How to generate a timechart from multiple data sources?

Explorer

This is working as expected.

0 Karma