Splunk Search

timechart sorting multiple fields

balash1979
Path Finder

I have the following query

index="search_index  | timechart avg(time1) as time1_in_mins ,avg(time2) as time2_in_mins |  sort time1 | tail 5 | sort time2 | tail 5

Basically, i want to show timechart values for 2 times and I want to sort both the times and show the top 5 values. By doing the above search, time2 is the one that gets sorted correctly. How can I fix the above query to sort both times.

0 Karma

HiroshiSatoh
Champion

Is this possible?

If there are 5 each

index="search_index  | timechart avg(time1) as time1_in_mins  |  sort time1_in_mins  | tail 5
|append [search index="search_index  | timechart avg(time2) as time2_in_mins | sort time2_in_mins | tail 5]

If there are 5 cases in total

index="search_index  |bin span=1h |stats (time1) as time1_in_mins ,avg(time2) as time2_in_mins by _time
|eval time=if(time1_in_mins <time2_in_mins,avtime1_in_mins,time2_in_mins)
|sort time|tail 5
0 Karma

balash1979
Path Finder

I have tried this way of appending 2 searches but the issue is if the first search completes first and the 2nd search takes time, the results dont come out correctly. Is there a way for the overall query to wait until both searches complete ?

0 Karma

HiroshiSatoh
Champion

Subsearch has the following restrictions.

[subsearch]: Search auto-finalized after time limit (60 seconds) reached.

It is necessary to change “limits.conf”.
https://answers.splunk.com/answers/267303/why-does-my-subsearch-maxtime-setting-in-limitscon.html

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...