Splunk Search

Merge two search results in one row

pankajad
Explorer

I have the below events and I want to merge the search results:

20171222.103330 Fr I - 0 Fn=makeRequest Endpoint=https://mydomain.api..net/v1/person/personid tid=e95126db-6184-4405-8c74-2ed978beb320 HttpStatusCode=200 ElapsedTime=55

I want to get the following result -

 ErrorRate   | tp90

I have the below two separate queries. How can I merge both queries -

index=abc "Fn=makeRequest"  HttpStatusCode > 201 AND HttpStatusCode !=404 |timechart bins=1000 count as ErrorRate
index=abc "Fn=makeRequest"  |timechart bins=1000 cont=FALSE  perc90(ElapsedTime) as perc90
0 Karma

acharlieh
Influencer

You can use eval in statistics commands to help you qualify fields e.g.:

index=abc "Fn=makeRequest" 
| timechart bins=1000 count(eval(HttpStatusCode > 201 AND HttpStatusCode !=404)) as ErrorRate perc90(ElapsedTime) as perc90
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...