Splunk Search

merge succesrate query with timechart

avikc100
Path Finder

how should I merge this 2 query into 1:

query 1)
index="XXXX" source="XXXX"|search "SupplierRTI_AlphaAesar" |stats count AS "Total",count(eval(STATUS=="fail")) AS Failure|eval Faliurerate=(Failure/Total)*100|eval SuccessRate=100-Faliurerate|table Total,SuccessRate

avikc100_0-1704637304447.png


query 2)


index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SupplierRTI.log"|search "SupplierRTI_AlphaAesar" | timechart span=1w count

avikc100_1-1704637354976.png

I want a report like this
how should I form the query?

avikc100_2-1704637625904.png

 

 

Labels (2)
0 Karma
1 Solution

dtburrows3
Builder

Give this a try

 

index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SupplierRTI.log" "SupplierRTI_AlphaAesar"
    | timechart span=1w
        count(eval('STATUS'=="fail")) as Failure,
        count as Total
    | eval
        Failurerate=('Failure'/'Total')*100,
        SuccessRate=100-'Failurerate'
    | fields + _time, Total, SuccessRate

 


Just by looking at your original queries I think the above SPL will do what you are asking for.
Though, your text of query1 shows the index as XXXXXX but the screenshot show the same index/source as query2 so I was a little confused by that part.

Let me know if you actually need to data from 2 different index/source together in a final report and I can give it another shot.
Example of output from simulated data:

dtburrows3_0-1704639455497.png

 

View solution in original post

0 Karma

dtburrows3
Builder

Give this a try

 

index="webmethods_prd" source="/apps/WebMethods/IntegrationServer/instances/default/logs/SupplierRTI.log" "SupplierRTI_AlphaAesar"
    | timechart span=1w
        count(eval('STATUS'=="fail")) as Failure,
        count as Total
    | eval
        Failurerate=('Failure'/'Total')*100,
        SuccessRate=100-'Failurerate'
    | fields + _time, Total, SuccessRate

 


Just by looking at your original queries I think the above SPL will do what you are asking for.
Though, your text of query1 shows the index as XXXXXX but the screenshot show the same index/source as query2 so I was a little confused by that part.

Let me know if you actually need to data from 2 different index/source together in a final report and I can give it another shot.
Example of output from simulated data:

dtburrows3_0-1704639455497.png

 

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...