Splunk Search

combine two tables into a multi series visualisation

splunk_ier
Engager

Hi Splunkers,

 

I have the below tables generates from the below queries and i'm looking for a consolidated multi-series view of both the tables into one panel with column chart visualisation

Query : 1

 

index=abc TYPE="Run bot*"|transaction BOT_NAME startswith=(TYPE="deployed") endswith=(TYPE="finished") 
|eval min=round((duration/60),2)|eval BOT_RUN_TIME_MINS=round(min,2)|eval BOT_Run_Completed_Timestamp=strftime(_time, "%Y-%m-%dT%H:%M:%S")|eval BOT_RUN_TIME_MINS=round(BOT_RUN_TIME_MINS) | timechart span=1d avg(BOT_RUN_TIME_MINS) as Average_Run_Time by BOT_NAME|

 

 

Table :1 

_timebot1bot2bot3bot4
2021-03-09 512326.5
2021-03-104859329.5
2021-03-11 510821
2021-03-12 911633
2021-03-13    
2021-03-14    
2021-03-15 3.7516068.5

 

Query 2 :

 

 

index=abc TYPE="Run bot*"|transaction BOT_NAME startswith=(TYPE="Deployed") endswith=(TYPE="finished") 
|eval min=round((duration/60),2)|eval BOT_RUN_TIME_MINS=round(min,2)|eval BOT_Run_Completed_Timestamp=strftime(_time, "%Y-%m-%dT%H:%M:%S")|eval BOT_RUN_TIME_MINS=round(BOT_RUN_TIME_MINS) | timechart span=1d count by DEVICE

 

 

Table 2:

_timedeviceAdeviceBdeviceCdeviceD
2021-03-098131
2021-03-1012150
2021-03-1111060
2021-03-1211080
2021-03-135010
2021-03-145020
2021-03-1512050
2021-03-164030

 

I want both bot info and device which it has run in the same multi series chart.

Please help me on this.Thanks in advance.Let me know for any other details.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Agent Mode Engaged! Enchaining Agentic Operations with Splunk AI Assistant 2.0

    Are you ready to transform how your team handles complex data requests? We invite you to our upcoming ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...