Splunk Search

How to perform stats count on all three indexes, and combine them to show as a Timechart?

kapilbk1996
Explorer

I have log file say A,B,C and their corresponding index is say index_A,index_B,index_C.
I want to perform stats count on all three indexes, and combine them to show as Timechart. I used the following query.

index="index_A"
"[ERROR]" | timechart count as
temp1 | appendcols [search index
= "index_B" | timechart count as temp2 ] |
appendcols [search index =
"index_C" | timechart
count as temp3]

alt text

This query is giving me correct result. The TImechart is shown above.
The issue is when I click on the Timechart to get the corresponding events for corresponding index, it always shows me the events of index_A only (even if I choose index_B or index_C).
This is because I had mentioned index_A at the starting of search query.

What changes do I need to make so that if I click on index other then index_A, I'll get the corresponding events?

0 Karma
1 Solution

niketn
Legend

@kapilbk1996, While using subsearches default drilldown will be limited to your main search. Following are your couple of options.

Option 1: Keep a single base search for various indexes:

(index="index_A" AND "[ERROR]") OR (index="index_B") OR (index="index_C") 
| timechart count by index 
| rename index_A as temp1 
| rename index_B as temp2 
| rename index_C as temp3

Option 2: Create your own drilldown using predefined drilldown tokens: https://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownIntro

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

0 Karma

niketn
Legend

@kapilbk1996, While using subsearches default drilldown will be limited to your main search. Following are your couple of options.

Option 1: Keep a single base search for various indexes:

(index="index_A" AND "[ERROR]") OR (index="index_B") OR (index="index_C") 
| timechart count by index 
| rename index_A as temp1 
| rename index_B as temp2 
| rename index_C as temp3

Option 2: Create your own drilldown using predefined drilldown tokens: https://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownIntro

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

kapilbk1996
Explorer

@ niketnilay thank you for quick response.
option 1 solved my issue.

Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...