Splunk Search

Merge two search results in one row

pankajad
Explorer

I have the below events and I want to merge the search results:

20171222.103330 Fr I - 0 Fn=makeRequest Endpoint=https://mydomain.api..net/v1/person/personid tid=e95126db-6184-4405-8c74-2ed978beb320 HttpStatusCode=200 ElapsedTime=55

I want to get the following result -

 ErrorRate   | tp90

I have the below two separate queries. How can I merge both queries -

index=abc "Fn=makeRequest"  HttpStatusCode > 201 AND HttpStatusCode !=404 |timechart bins=1000 count as ErrorRate
index=abc "Fn=makeRequest"  |timechart bins=1000 cont=FALSE  perc90(ElapsedTime) as perc90
0 Karma

acharlieh
Influencer

You can use eval in statistics commands to help you qualify fields e.g.:

index=abc "Fn=makeRequest" 
| timechart bins=1000 count(eval(HttpStatusCode > 201 AND HttpStatusCode !=404)) as ErrorRate perc90(ElapsedTime) as perc90
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...