Join multiple search queries to get the consolidated result

[kodali2105]

Hi,
I have the below search queries and I want to combine these two queries in to one query.

query 1:
cbs2_req_res.log OR Complete with HTTP Response code | rex "(?i).*?\->(?P\w+)(?=:)" | rex "Complete with HTTP Response code : (?\d+)" | timechart span=1d count(http_response_code)

query 2:
cbs2_req_res.log OR Finished execution of method | rex "(?i).*?\->(?P\w+)(?=:)" | timechart span=1d count

Can you some one please help me to get the combined query?

[woodcock]

I agree with sideview: your base search is definitely wrong and I think his first suggestion is what you intended. Additionally, all of your 'rex' commands are broken (or unused). Also, I suspect your "count" command is not doing what you would like it to do. Finally, I am unclear on your end goal ("how" you would like to join them). If you would simply like multiple lines to chart on the same graph, maybe this is what you are trying to do:

source=cbs2_req_res.log ("Finished execution of method" OR "Complete with HTTP Response code") | rex "Complete with HTTP Response code : (?\\d+)" | timechart span=1d count(isnotnull(http_response_code)) AS httpCount, count AS allCount | eval finishedExecutionCount = allCount - httpCount

This gives you 3 sets of (related) data and 3 lines to chart.

P.S. I know part of the problem is markdown mucking up what you typed (which is also why the "d+" in the code example of my answer above is missing the backslash; I could not figure out how to get it to format correctly with markdown)

[sideview]

What you're doing with the OR's looks a little strange. What these are telling Splunk is (cbs2_req_res.log OR Complete) with HTTP Response code. Meaning find events that have either "cbs2_req_res.log" or the word "Complete" in them, and that also have the words "with", "HTTP", "Response" and "code" in them.

Can you confirm or edit your searches to fix?

For example you might be intending to search for

cbs2_req_res.log OR "Complete with HTTP Response code"

or maybe you intended something like::

(cbs2_req_res.log OR Complete) "with HTTP Response code"