Splunk Search

how to combine two searches into one chart using checkbox input value

florapann
Engager

i have initial query with one index name(index1)  which show F10N F10W F11 etc values in one chart but for F6 value comes from different index (index2) . how should i combine that F6 value into one chart.

index1 : MicronSite IN($input_site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?<AvgTotalTrackoutTime>\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h by MicronSite

index2 : MicronSite=F6 index=mfg source=command_times area_id=Fabwide command_name IN (SigmaRunComplete,MESLotTrackOut)
| timechart partial=f span=12h aligntime=@d+7h avg(avg) by command_name
| addtotals fieldname=AvgTotalTrackoutTime

florapann_0-1636299153644.png

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index1 : MicronSite IN($input_site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?<AvgTotalTrackoutTime>\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h by MicronSite
| join type=left _time [
search index2 : MicronSite=F6 index=mfg source=command_times area_id=Fabwide command_name IN (SigmaRunComplete,MESLotTrackOut)
| timechart partial=f span=12h aligntime=@d+7h avg(avg) by command_name
| addtotals fieldname=AvgTotalTrackoutTime
]
0 Karma

florapann
Engager

when i run the query , it shows below like this. how should i remove that  two column from chart?

florapann_0-1636339702191.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fields - MESLofTrackOut SignalRunComplete
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...