Splunk Search

Combine result from 2 queries into same bar chart

hardywang
Explorer

I see such questions are frequently asked on this forum, but I still don't get a clear picture yet.

I have my first query index=same-index source="same-source" "first-query-static-text" | eval date=strftime(_time, "%Y-%m-%d") | chart count over date and I add it to my dashboard's panel as column chart. Everything is working fine.

My second query index=same-index source="same-source" | regex log="second-query-regex" | eval date=strftime(_time, "%Y-%m-%d") | chart count over date and I add it to my dashboard's panel as column chart. Everything is working fine.

Now I have to column charts, each from its own query.

What I want is to have 1 single column chart, each date on x axis has 2 columns (1 value from each query) and use different colours to indicate what is the value for.

Any suggestions?

0 Karma
1 Solution

jpolvino
Builder

One way to do this would be to give each search result set its own name, and use that for the series. The multisearch command may help:

| multisearch
[search index=same-index source="same-source" "first-query-static-text" | eval date=strftime(_time, "%Y-%m-%d") | eval seriesName="First"]
[search index=same-index source="same-source" | regex log="second-query-regex" | eval date=strftime(_time, "%Y-%m-%d") | eval seriesName="Second"]
chart count over date by seriesName

I don't use the chart command often, so this might not be solid. Using timechart the last line might look like | timechart span=1d count by seriesName

View solution in original post

mydog8it
Builder

Give this a look and see if it is what you are after...

    index=same-index source="same-source" "first-query-static-text" 
    | bucket _time span=1d 
    | timechart count AS first_query_count 
    | appendcols 
        [ search index=same-index source="same-source" 
        | regex log="second-query-regex" 
        | bucket _time span=1d 
        | timechart count AS second_query_count 
        | fields second_query_count]
0 Karma

jpolvino
Builder

One way to do this would be to give each search result set its own name, and use that for the series. The multisearch command may help:

| multisearch
[search index=same-index source="same-source" "first-query-static-text" | eval date=strftime(_time, "%Y-%m-%d") | eval seriesName="First"]
[search index=same-index source="same-source" | regex log="second-query-regex" | eval date=strftime(_time, "%Y-%m-%d") | eval seriesName="Second"]
chart count over date by seriesName

I don't use the chart command often, so this might not be solid. Using timechart the last line might look like | timechart span=1d count by seriesName

hardywang
Explorer

Your suggestion worked perfectly! I will also explore timechart command.

I am learning splunk, lots to explore.

hardywang
Explorer

Once I start to use timechart and simplify the query this way, I don't get anything back. Is it a wrong syntax?

| multisearch
 [search index=same-index source="same-source" "first-query-static-text" | eval seriesName="First"]
 [search index=same-index source="same-source" | regex log="second-query-regex" | eval seriesName="Second"]
 | timechart span=1d count by seriesName
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...