Splunk Search

how to combine two searches into one chart using checkbox input value

florapann
Engager

i have initial query with one index name(index1)  which show F10N F10W F11 etc values in one chart but for F6 value comes from different index (index2) . how should i combine that F6 value into one chart.

index1 : MicronSite IN($input_site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?<AvgTotalTrackoutTime>\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h by MicronSite

index2 : MicronSite=F6 index=mfg source=command_times area_id=Fabwide command_name IN (SigmaRunComplete,MESLotTrackOut)
| timechart partial=f span=12h aligntime=@d+7h avg(avg) by command_name
| addtotals fieldname=AvgTotalTrackoutTime

florapann_0-1636299153644.png

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index1 : MicronSite IN($input_site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?<AvgTotalTrackoutTime>\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h by MicronSite
| join type=left _time [
search index2 : MicronSite=F6 index=mfg source=command_times area_id=Fabwide command_name IN (SigmaRunComplete,MESLotTrackOut)
| timechart partial=f span=12h aligntime=@d+7h avg(avg) by command_name
| addtotals fieldname=AvgTotalTrackoutTime
]
0 Karma

florapann
Engager

when i run the query , it shows below like this. how should i remove that  two column from chart?

florapann_0-1636339702191.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fields - MESLofTrackOut SignalRunComplete
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...