one report with two metrics

[vinod0313]

HI I have two queries ,and i need to display the results from the both the queries in one line graph report

[aasabatini]

Hi @vinod0313 

you can try to use a subsearch but be careful because subsearches works fine with a small set of data

https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchTutorial/Useasubsearch

anyway if you want share your searches or explain your case the community can help you better

Regards

Alessandro

[vinod0313]

HI @aasabatini 

I am joining two queries in order to show both result in one graph,please refer below query

index="cx_aws" host="aw-lx0244.deltadev.ent" source ="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode|bucket _time span=1h | stats count by _time |append [search index="cx_aws" host="aw-lx0244.deltadev.ent" source="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode | eval TimeTaken3 = trim(replace(TimeTaken, ",","")) | eval REQUESTED_URL2 = trim(replace(REQUESTED_URL, "/contracts/",""))| eval REQUESTED_URL3 = trim(replace(REQUESTED_URL2, "/enrollees","")) | sort -num(TimeTaken3) | WHERE TimeTaken3>10000|bucket _time span=1h | stats count by _time]


But i am getting only one graph,in this graph only both query results are showing,refer below

vinod0313_0-1621332627230.png

but i need two lines (one for each query) in the graph

[aasabatini]

Hi @vinod0313 

sorry for the late reply.

I think you set the count field with the same name, try to modify the count name for each search.

example

index="cx_aws" host="aw-lx0244.deltadev.ent" source ="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode|bucket _time span=1h | stats count as search1_count by _time |append [search index="cx_aws" host="aw-lx0244.deltadev.ent" source="pf-enrollee-family-roster-service" AND ("/persons/" OR "/contracts/") AND HttpStatusCode | eval TimeTaken3 = trim(replace(TimeTaken, ",","")) | eval REQUESTED_URL2 = trim(replace(REQUESTED_URL, "/contracts/",""))| eval REQUESTED_URL3 = trim(replace(REQUESTED_URL2, "/enrollees","")) | sort -num(TimeTaken3) | WHERE TimeTaken3>10000|bucket _time span=1h | stats count as search2_count by _time]