Splunk Search

Splunk combine timechart result from two queries

officialsubho
New Member

Have the following queries

query 1 - cf_org_name="xxx" cf_space_name="yyy" cf_app_name=zzz index=123* msg= "Transaction completed" | timechart count AS Succesfull_Tran span=60m

query 2 - cf_org_name="xxx" cf_space_name="yyy" cf_app_name=zzz index=123* msg= "ERROR" | timechart count AS Failed_Tran span=60m

Need help to combine the resultset into a single timechart table . Tried append and it dosent not give the desired output .

Desired Output

_time | Succesfull_Tran | Failed_Tran

0 Karma

woodcock
Esteemed Legend

Like this:

index="123*" AND cf_org_name="xxx" AND cf_space_name="yyy" AND cf_app_name="zzz" 
| timechart span=60m count(eval(msg="ERROR")) AS Failed_Tran count(eval(msg="Transaction completed")) AS Succesfull_Tran 
0 Karma

Anantha123
Communicator

Hi,

Try this too

cf_org_name="xxx" cf_space_name="yyy" cf_app_name=zzz index=123*
| timechart span=1h count as Total , count(eval(msg="Transaction completed")) as Succesfull_Tran , count(eval(msg="ERROR")) as Failed_Tran

0 Karma

jacobpevans
Motivator

| timechart span=60m count by msg

You can also create a new variable and timechart by that

| eval Success = if(msg="Transaction Completed","Success","Error")
| timechart span=60m count by Success

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...