Splunk Search

combine searches in one timechart

bowa
Path Finder

I would like to combine the following two searches in one timechart:

host="appserv" OAuth participants POST | regex _raw="/organizations/[a-z0-9-]*/participants/?$" | timechart count

and

host="appserv" deadlock | timechart count

sounds pretty simple question but i cant find how to do it.

1 Solution

twinspop
Influencer

Many ways to skin this cat. appendcols came to mind first:

host="appserv" OAuth participants POST earliest=-1h@h latest=-0h@h | 
regex _raw="/organizations/[a-z0-9-]*/participants/?$" |
timechart count as OAuthCount |
appendcols [ search host="appserv" deadlock earliest=-1h@h latest=-0h@h | 
    timechart count as deadlockCount | fields deadlockCount ]

So you run the first search roughly as is. Add in a time qualifier for grins, and rename the count column to something unambiguous. Pipe the results of that into an appendcols that uses a subsearch reflecting the second search (same mods), and pipe that into fields to isolate just the count of deadlocks. Finally, close the subsearch.

I make no claim that this is the best way.

View solution in original post

twinspop
Influencer

Many ways to skin this cat. appendcols came to mind first:

host="appserv" OAuth participants POST earliest=-1h@h latest=-0h@h | 
regex _raw="/organizations/[a-z0-9-]*/participants/?$" |
timechart count as OAuthCount |
appendcols [ search host="appserv" deadlock earliest=-1h@h latest=-0h@h | 
    timechart count as deadlockCount | fields deadlockCount ]

So you run the first search roughly as is. Add in a time qualifier for grins, and rename the count column to something unambiguous. Pipe the results of that into an appendcols that uses a subsearch reflecting the second search (same mods), and pipe that into fields to isolate just the count of deadlocks. Finally, close the subsearch.

I make no claim that this is the best way.

jcai_splunk
Splunk Employee
Splunk Employee

Cool! exactly what I want!

0 Karma

bowa
Path Finder

thanks a lot 🙂 appendcols is my friend now!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...