Splunk Search

how to combine two searches into one chart using checkbox input value

florapann
Engager

i have initial query with one index name(index1)  which show F10N F10W F11 etc values in one chart but for F6 value comes from different index (index2) . how should i combine that F6 value into one chart.

index1 : MicronSite IN($input_site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?<AvgTotalTrackoutTime>\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h by MicronSite

index2 : MicronSite=F6 index=mfg source=command_times area_id=Fabwide command_name IN (SigmaRunComplete,MESLotTrackOut)
| timechart partial=f span=12h aligntime=@d+7h avg(avg) by command_name
| addtotals fieldname=AvgTotalTrackoutTime

florapann_0-1636299153644.png

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index1 : MicronSite IN($input_site$) index=mtparam sourcetype=CommandTimesByArea | rex field=_raw "Fabwide:AvgTotalTrackoutTime\s+(?<AvgTotalTrackoutTime>\d+)" | timechart span=12h avg(AvgTotalTrackoutTime) aligntime=@d+7h by MicronSite
| join type=left _time [
search index2 : MicronSite=F6 index=mfg source=command_times area_id=Fabwide command_name IN (SigmaRunComplete,MESLotTrackOut)
| timechart partial=f span=12h aligntime=@d+7h avg(avg) by command_name
| addtotals fieldname=AvgTotalTrackoutTime
]
0 Karma

florapann
Engager

when i run the query , it shows below like this. how should i remove that  two column from chart?

florapann_0-1636339702191.png

 

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| fields - MESLofTrackOut SignalRunComplete
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...