Splunk Search

help to timechart after an append command

jip31
Motivator

hello

I use a search with the structure like below in order to timechart events from 2 different search

As you can see, I need to perc90 the events before doing a timechart

My question concerns the timechart 

Is there a way to timechart the events without using an avg function?

index=toto
| search abc <=1000
| stats perc90(abc) as "titi" by _time 
| append 
    [ search index=toto 
    | search abc >= 1000 
    | stats perc90(abc) as "tutu" by _time ] 
| timechart span=1m avg("titi") as "titi", avg("tutu") as "tutu"

Thanks

Tags (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

did you tried something like this?

 

index=toto
| eval kind=if(abc<=1000,"titi","tutu")
| timechart perc90(abc) BY kind 

 

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

did you tried something like this?

 

index=toto
| eval kind=if(abc<=1000,"titi","tutu")
| timechart perc90(abc) BY kind 

 

Ciao.

Giuseppe

0 Karma

jip31
Motivator

Hi Gcusello, good idea thanks

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jip31,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...