Splunk Search

help to timechart after an append command

jip31
Motivator

hello

I use a search with the structure like below in order to timechart events from 2 different search

As you can see, I need to perc90 the events before doing a timechart

My question concerns the timechart 

Is there a way to timechart the events without using an avg function?

index=toto
| search abc <=1000
| stats perc90(abc) as "titi" by _time 
| append 
    [ search index=toto 
    | search abc >= 1000 
    | stats perc90(abc) as "tutu" by _time ] 
| timechart span=1m avg("titi") as "titi", avg("tutu") as "tutu"

Thanks

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

did you tried something like this?

 

index=toto
| eval kind=if(abc<=1000,"titi","tutu")
| timechart perc90(abc) BY kind 

 

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

did you tried something like this?

 

index=toto
| eval kind=if(abc<=1000,"titi","tutu")
| timechart perc90(abc) BY kind 

 

Ciao.

Giuseppe

0 Karma

jip31
Motivator

Hi Gcusello, good idea thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...