Splunk Search

Query help with search using sum(count) and 2 subsearches using count

subtrakt
Contributor

I have a query that combines 1 search and 2 sub-searches. The main search is a summary index and sum(count) in the timechart to look right. The 2 sub searches do not need sum(count) - they just need "count" so they are represented properly on the timechart.

I was thinking if there was a way to convert sum(count) to count I would be good.

This summary index runs every 15 minutes and buckets by the minute:

Here's my Attempt to translate sum(count) to count:
index="summary_onemin" error | evenstats sum(count) as count by _time | append [| search index=power_user "null" | bucket _time span=2m | eval CODE=powerNULL] | timechart span=2m by CODE

Without the subsearch the search would look like this and works as intended:
index="summary_onemin" error | timechart sum(count) as COUNT by CODE

1 Solution

somesoni2
Revered Legend

Try this

 index="summary_onemin" error | table _time CODE count 
| append [search index=power_user "null" | bucket _time span=2m | eval CODE=powerNULL
| stats count by _time, CODE] 
| timechart span=2m sum(count) as count by CODE

View solution in original post

somesoni2
Revered Legend

Try this

 index="summary_onemin" error | table _time CODE count 
| append [search index=power_user "null" | bucket _time span=2m | eval CODE=powerNULL
| stats count by _time, CODE] 
| timechart span=2m sum(count) as count by CODE

subtrakt
Contributor

Thanks Somesoni!

0 Karma

somesoni2
Revered Legend

Can you post your full search?

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...