Splunk Search

merge succesrate query with timechart

avikc100
Path Finder

how should I merge this 2 query into 1:

query 1)
index="XXXX" source="XXXX"|search "SupplierRTI_AlphaAesar" |stats count AS "Total",count(eval(STATUS=="fail")) AS Failure|eval Faliurerate=(Failure/Total)*100|eval SuccessRate=100-Faliurerate|table Total,SuccessRate

avikc100_0-1704637304447.png


query 2)


index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SupplierRTI.log"|search "SupplierRTI_AlphaAesar" | timechart span=1w count

avikc100_1-1704637354976.png

I want a report like this
how should I form the query?

avikc100_2-1704637625904.png

 

 

Labels (2)
0 Karma
1 Solution

dtburrows3
Builder

Give this a try

 

index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SupplierRTI.log" "SupplierRTI_AlphaAesar"
    | timechart span=1w
        count(eval('STATUS'=="fail")) as Failure,
        count as Total
    | eval
        Failurerate=('Failure'/'Total')*100,
        SuccessRate=100-'Failurerate'
    | fields + _time, Total, SuccessRate

 


Just by looking at your original queries I think the above SPL will do what you are asking for.
Though, your text of query1 shows the index as XXXXXX but the screenshot show the same index/source as query2 so I was a little confused by that part.

Let me know if you actually need to data from 2 different index/source together in a final report and I can give it another shot.
Example of output from simulated data:

dtburrows3_0-1704639455497.png

 

View solution in original post

0 Karma

dtburrows3
Builder

Give this a try

 

index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SupplierRTI.log" "SupplierRTI_AlphaAesar"
    | timechart span=1w
        count(eval('STATUS'=="fail")) as Failure,
        count as Total
    | eval
        Failurerate=('Failure'/'Total')*100,
        SuccessRate=100-'Failurerate'
    | fields + _time, Total, SuccessRate

 


Just by looking at your original queries I think the above SPL will do what you are asking for.
Though, your text of query1 shows the index as XXXXXX but the screenshot show the same index/source as query2 so I was a little confused by that part.

Let me know if you actually need to data from 2 different index/source together in a final report and I can give it another shot.
Example of output from simulated data:

dtburrows3_0-1704639455497.png

 

0 Karma
Get Updates on the Splunk Community!

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

What's New in Splunk Observability - October 2025

What’s New?    We’re excited to announce the latest enhancements to Splunk Observability Cloud and share ...