Splunk Search

Merge two search results in one row

pankajad
Explorer

I have the below events and I want to merge the search results:

20171222.103330 Fr I - 0 Fn=makeRequest Endpoint=https://mydomain.api..net/v1/person/personid tid=e95126db-6184-4405-8c74-2ed978beb320 HttpStatusCode=200 ElapsedTime=55

I want to get the following result -

 ErrorRate   | tp90

I have the below two separate queries. How can I merge both queries -

index=abc "Fn=makeRequest"  HttpStatusCode > 201 AND HttpStatusCode !=404 |timechart bins=1000 count as ErrorRate
index=abc "Fn=makeRequest"  |timechart bins=1000 cont=FALSE  perc90(ElapsedTime) as perc90
0 Karma

acharlieh
Influencer

You can use eval in statistics commands to help you qualify fields e.g.:

index=abc "Fn=makeRequest" 
| timechart bins=1000 count(eval(HttpStatusCode > 201 AND HttpStatusCode !=404)) as ErrorRate perc90(ElapsedTime) as perc90
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...