Splunk Search

How to combine multiple searches into 1 related table/graph?

lordhans
Explorer

I have two searches something like this:

"ns=my_project" message="*RESPONSE_CODE=200*" OR "*RESPONSE_CODE=400*" METHOD=API1 add|top RESPONSE_CODE
"ns=my_project" message="*RESPONSE_CODE=200*" OR "*RESPONSE_CODE=400*" METHOD=API2 something_else|top RESPONSE_CODE

I want to combine them into one graph/table that will look something like this:
alt text

Any help or ideas are greatly appreciated!
Thanks.

0 Karma

woodcock
Esteemed Legend

Try this:

index=YourIndexHere sourcetype=YourSourcetypeHere "ns=my_project" message="*RESPONSE_CODE=200*" OR "*RESPONSE_CODE=400*" ((METHOD="API1" AND "add") OR (METHOD="API2" AND "something_else")
| stats count(eval(searchmatch(message="*RESPONSE_CODE=200*"))) AS "Response 200" count(eval(searchmatch(message="*RESPONSE_CODE=400*"))) AS "Response 400" BYMETHOD
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

start with this...

index=foo "ns=my_project" 
(message="*RESPONSE_CODE=200*" OR message="*RESPONSE_CODE=400*")
((METHOD="API1" and "add") OR (METHOD="API2" and "something_else"))
| stats count as eventcount by METHOD RESPONSE_CODE
| chart sum(eventcount) by METHOD RESPONSE_CODE

The above code has not used the top command to limit the responses, but if you only have 2 response codes, then top is redundant.

Here's a run-anywhere sample to show how it works...

| makeresults | eval METHOD="API1 API2 API3" | makemv METHOD | mvexpand METHOD
| eval RESPONSE_CODE="200 400" | makemv RESPONSE_CODE| mvexpand RESPONSE_CODE
| eval rand=random()%155
| rename COMMENT as "The above just generates test data."

| stats sum(rand) as eventcount by METHOD RESPONSE_CODE
| chart sum(eventcount) by METHOD RESPONSE_CODE
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...