Splunk Search
Highlighted

Splunk combine timechart result from two queries

New Member

Have the following queries

query 1 - cforgname="xxx" cfspacename="yyy" cfappname=zzz index=123* msg= "Transaction completed" | timechart count AS Succesfull_Tran span=60m

query 2 - cforgname="xxx" cfspacename="yyy" cfappname=zzz index=123* msg= "ERROR" | timechart count AS Failed_Tran span=60m

Need help to combine the resultset into a single timechart table . Tried append and it dosent not give the desired output .

Desired Output

time | SuccesfullTran | Failed_Tran

0 Karma
Highlighted

Re: Splunk combine timechart result from two queries

Motivator

| timechart span=60m count by msg

You can also create a new variable and timechart by that

| eval Success = if(msg="Transaction Completed","Success","Error")
| timechart span=60m count by Success

Cheers,
Jacob
0 Karma
Highlighted

Re: Splunk combine timechart result from two queries

Communicator

Hi,

Try this too

cforgname="xxx" cfspacename="yyy" cfappname=zzz index=123*
| timechart span=1h count as Total , count(eval(msg="Transaction completed")) as SuccesfullTran , count(eval(msg="ERROR")) as FailedTran

0 Karma
Highlighted

Re: Splunk combine timechart result from two queries

Esteemed Legend

Like this:

index="123*" AND cf_org_name="xxx" AND cf_space_name="yyy" AND cf_app_name="zzz" 
| timechart span=60m count(eval(msg="ERROR")) AS Failed_Tran count(eval(msg="Transaction completed")) AS Succesfull_Tran 
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.