Hi - I'm having trouble in combining 2 separate searches and displaying the results on a single visualization (timechart). search 1 searches for events in the access log and search 2 searches for events in another log file (process log). Both log files have a field called "responseTime". In the process log the responseTime field represents "Processing Time". I'm able to run the searches independently and plot the timechart but when I combine them using join I don't get back any results. If I use append I get back results only from search 2. I am looking for 2 lines on the same timechart - one that represents processing time (from process log) and the other would be response time (from access log). search1: index=xxx source=/x/x/x/localhost_access_log* field=value1 search2: index=xxx source=/x/x/x/process_log field=value2 Using join I tried the following queries: (No results) search1 | join [search2 | rename responseTime as processTime] | timechart avg(responseTime), avg(processTime) (and) search1 | timechart avg(responseTime) | join [search2 | timechart avg(responseTime)] Using append: (got back results only from search2) search1 | append [search2 | rename responseTime as processTime] | timechart avg(responseTime), avg(processTime) ... View more

Hello I have a dashboard with a drop-down containing 3 choices. If choice 3 is selected, I want to show a panel. If choices 1 or 2 are selected, that panel should be hidden. I do see a few posts related to this, but they are not doing the trick for me. I see I have to use , . Dashboard is Simple XML. Splunk version is 6.4.1.2. The weird thing is, it worked yesterday and I tested it multiple times. I don't remember changing anything, but it is not working today. I tried the "depends" on the and tags but it's not working. xxx xxx <input type="dropdown" token="type"> <label>type</label> <choice value="a">A</choice> <choice value="b">B</choice> <choice value="c">C</choice> <default>a</default> <change> <condition value="a"> <unset token="a-details"></unset> <unset token="b-details"></unset> <set token="c-details"></set> </condition> <condition value="b"> <unset token="a-details"></unset> <unset token="c-details"></unset> <set token="b-details"></set> </condition> <condition value="c"> <unset token="a-details"></unset> <unset token="b-details"></unset> <set token="c-details"></set> </condition> </change> </input> <panel depends="$c-details$"> <chart> <title></title> <search> <query>xxxx</query> <earliest>$time_tok.earliest$</earliest> <latest>$time_tok.latest$</latest> </search> </chart> </panel> ... View more

Hi, I'm new to Splunk and I'm looking for some help with plotting a timechart to show requests per sec. Thanks in advance. I currently have a dashboard panel that shows transactions (or requests)/second. The user chooses the time range and span from a drop-down and TPS is plotted for that time range. This is the search I'm using. search string | timechart span=$tok_span$ count | timechart per_second(count) This works great, but the search string returns all services grouped under a certain category that is filtered by the url string. Now I need to plot the same metric (TPS) for each service (and there is like 10 of them). I have an eventtype created for each service. My problem is timechart per_second() works only for a single integer value count, but I want to be able to plot this for each service on the same timechart. Any thoughts are greatly appreciated. Thanks! ... View more