×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
ashbhaic
Explorer
Member since: ‎12-15-2014
‎06-05-2020
Community Statistics
Posts 4
Solutions 1
Karma Given 7
Karma Received 2
Member Since ‎12-15-2014
Activity Feed
View All

Re: How to compare results of same search for two ...

by in Splunk Search
‎12-19-2014 08:30 AM
1 Karma
‎12-19-2014 08:30 AM
1 Karma
Ok .. so i figured out a way to do this ... All answers point to use of append but were plotting the data on a timechart . My need is to plot the number of services that were invoked against the channel where they were invoked and do a comparision side by side and append was way too slow. Below is what I used and gives me exactly what I am looking for : |multisearch [search index=realtimelogs earliest=-15m@m | eval id="15m back"] [search index=realtimelogs earliest=-30m@m latest=-15m@m | eval id="30m back"] | chart count(SERVICE) by channel id It plots as a Bar chart (sadly I dont have enought points to post pic here 😞 ) with two bars each channel showing the count of services that were invoked between now-15m back and 15m-30m back. ... View more

How to compare results of same search for two diff...

by in Splunk Search
‎12-19-2014 08:13 AM
1 Karma
‎12-19-2014 08:13 AM
1 Karma
I have logs which tell me the service name, time and domain name where this service was called. I have a query to chart the number of services that were invoked for each domain (channel) as below : index=realtimelogs earliest=-15m@m | chart count(SERVICE) AS "No. of Services Invoked" by channel It results in below : channel No. of Services Invoked TSYS 1234 Fidelity 2345 I am looking for a single query that can pull the count in two different time intervals so that I can compare the count by channel in those two time ranges. (I am looking for a way to add a new column to the existing result which lists data from a different time range. I am not looking for plotting the results against time. I just need a side by side comparison. ... View more

Re: Can PDF reports be created & saved without ema...

by in Reporting
‎12-18-2014 08:13 AM
‎12-18-2014 08:13 AM
Does anyone have an update to it ? ... View more

Re: Truncated scheduled report in PDF

by in Reporting
‎12-15-2014 11:24 AM
‎12-15-2014 11:24 AM
Does anyone have an answer to this question ? I am also facing similar problem in the scheduled PDF delivery. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma from
View All
Karma given to