Splunk Search

Splunk query to merge 2 timecharts as overlay



I have 2 timecharts that are working independently, can you help to merge both to one query (as overylay), the modified query should show timecharts based on 2 different source types and different criteria's.

Query 1 : index=index1 sourcetype="sourcetype1" "SearchString1"|timechart count span=1h
Query 2 : index=index1 sourcetype=sourcetype2 "SearchString2"=* | timechart count by "SearchString2"

Tags (1)
0 Karma


Hi somesoni2,

thanks for your input, I tried and it seems its not considering SearchString1 values, could you help me understand in detail as i could try/tweak it.

Mathan J

0 Karma

Revered Legend

Give this a try

index=index1 (sourcetype="sourcetype1" "SearchString1") OR (sourcetype=sourcetype2 "SearchString2"=*)
| eval "SearchString2"=if(sourcetype="sourcetype1","count",'SearchString2')
| timechart count by "SearchString2"
0 Karma
Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...