Splunk Search
Highlighted

Timechart in the same table based on column

Explorer

Hi,

I have the below 2 searches, which work fine. I need to put the output of both the searches in a single table so the whole data is displayed over ClusterName. Please let me know how I can achieve this.

sourcetype = aaa_sss* eventtype=* | chart values(eventtype) AS Events over clusterName |

clusterName=xxx | timechart span=1m count by eventtype | eval count = ceiling(count/16)
0 Karma
Highlighted

Re: Timechart in the same table based on column

SplunkTrust
SplunkTrust

What the expected (sample) resulting table? (what columns? show some sample values)

0 Karma
Highlighted

Re: Timechart in the same table based on column

Champion

Is it like this?
※I do not consider performance etc.

 sourcetype = aaa_sss* eventtype=* | chart values(eventtype) AS Events over clusterName 
|map search="search clusterName=$clusterName$
|eval eventtype=\"$eventtype$\"|timechart span=1m count by eventtype|eval clusterName=\"$clusterName$\""
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.