Splunk Search

Combine result from 2 queries into same bar chart

hardywang
Explorer

I see such questions are frequently asked on this forum, but I still don't get a clear picture yet.

I have my first query index=same-index source="same-source" "first-query-static-text" | eval date=strftime(_time, "%Y-%m-%d") | chart count over date and I add it to my dashboard's panel as column chart. Everything is working fine.

My second query index=same-index source="same-source" | regex log="second-query-regex" | eval date=strftime(_time, "%Y-%m-%d") | chart count over date and I add it to my dashboard's panel as column chart. Everything is working fine.

Now I have to column charts, each from its own query.

What I want is to have 1 single column chart, each date on x axis has 2 columns (1 value from each query) and use different colours to indicate what is the value for.

Any suggestions?

0 Karma
1 Solution

jpolvino
Builder

One way to do this would be to give each search result set its own name, and use that for the series. The multisearch command may help:

| multisearch
[search index=same-index source="same-source" "first-query-static-text" | eval date=strftime(_time, "%Y-%m-%d") | eval seriesName="First"]
[search index=same-index source="same-source" | regex log="second-query-regex" | eval date=strftime(_time, "%Y-%m-%d") | eval seriesName="Second"]
chart count over date by seriesName

I don't use the chart command often, so this might not be solid. Using timechart the last line might look like | timechart span=1d count by seriesName

View solution in original post

mydog8it
Builder

Give this a look and see if it is what you are after...

    index=same-index source="same-source" "first-query-static-text" 
    | bucket _time span=1d 
    | timechart count AS first_query_count 
    | appendcols 
        [ search index=same-index source="same-source" 
        | regex log="second-query-regex" 
        | bucket _time span=1d 
        | timechart count AS second_query_count 
        | fields second_query_count]
0 Karma

jpolvino
Builder

One way to do this would be to give each search result set its own name, and use that for the series. The multisearch command may help:

| multisearch
[search index=same-index source="same-source" "first-query-static-text" | eval date=strftime(_time, "%Y-%m-%d") | eval seriesName="First"]
[search index=same-index source="same-source" | regex log="second-query-regex" | eval date=strftime(_time, "%Y-%m-%d") | eval seriesName="Second"]
chart count over date by seriesName

I don't use the chart command often, so this might not be solid. Using timechart the last line might look like | timechart span=1d count by seriesName

hardywang
Explorer

Your suggestion worked perfectly! I will also explore timechart command.

I am learning splunk, lots to explore.

hardywang
Explorer

Once I start to use timechart and simplify the query this way, I don't get anything back. Is it a wrong syntax?

| multisearch
 [search index=same-index source="same-source" "first-query-static-text" | eval seriesName="First"]
 [search index=same-index source="same-source" | regex log="second-query-regex" | eval seriesName="Second"]
 | timechart span=1d count by seriesName
0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...