Splunk Search

Is it possible to implement base search in query with multiple appendcols

ronsri
Observer

index=test sourcetype=test_access tag=prod server_name!="www.test.com" earliest=-4h latest=now | timechart eval(avg(request_time)*1000) as "Today" | appendcols [search index=test sourcetype=test_access tag=prod server_name!="www.test.com" earliest=-7d-4h latest=-7d | timechart eval(avg(request_time)*1000) as "LW1"] | appendcols [search index=test sourcetype=test_access tag=prod server_name!="www.test.com" earliest=-14d-4h latest=-14d | timechart eval(avg(request_time)*1000) as "LW2"]base-search

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It is just a search - try it 😀

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...