Splunk Search
Highlighted

How to perform stats count on all three indexes, and combine them to show as a Timechart?

Explorer

I have log file say A,B,C and their corresponding index is say indexA,indexB,index_C.
I want to perform stats count on all three indexes, and combine them to show as Timechart. I used the following query.

index="indexA"
"[ERROR]" | timechart count as
temp1 | appendcols [search index
= "index
B" | timechart count as temp2 ] |
appendcols [search index =
"index_C" | timechart
count as temp3]

alt text

This query is giving me correct result. The TImechart is shown above.
The issue is when I click on the Timechart to get the corresponding events for corresponding index, it always shows me the events of indexA only (even if I choose indexB or indexC).
This is because I had mentioned index
A at the starting of search query.

What changes do I need to make so that if I click on index other then index_A, I'll get the corresponding events?

0 Karma
Highlighted

Re: How to perform stats count on all three indexes, and combine them to show as a Timechart?

Legend

@kapilbk1996, While using subsearches default drilldown will be limited to your main search. Following are your couple of options.

Option 1: Keep a single base search for various indexes:

(index="index_A" AND "[ERROR]") OR (index="index_B") OR (index="index_C") 
| timechart count by index 
| rename index_A as temp1 
| rename index_B as temp2 
| rename index_C as temp3

Option 2: Create your own drilldown using predefined drilldown tokens: https://docs.splunk.com/Documentation/Splunk/latest/Viz/DrilldownIntro




| eval message="Happy Splunking!!!"


View solution in original post

0 Karma
Highlighted

Re: How to perform stats count on all three indexes, and combine them to show as a Timechart?

Explorer

@ niketnilay thank you for quick response.
option 1 solved my issue.