How to edit my search to add row header labels to the table of results?

[vivekb]

I have created following Splunk search:

host=xyz* index=my_index NOT(bot) earliest=-1d@d latest=-0d@d | eval searchid="Today" | stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404 | append [ search index=my_index host=pdap* index=os_web NOT(bot) earliest=-2d@d latest=-1d@d |eval searchid="Yesterday" | stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404]

Following is the result:

Exceptions              Errors             404
58                      95                 49
59                      135               94

My Question is: How do I add row labels like Today for first row and Yesterday for second row?

[ppablo]

Hi @vivekb

Don't forget to resolve your question by clicking "Accept" below the answer you decided to go with!

Patrick

[vivekb]

Done. Thanks Patrick!

[alacercogitatus]

You can combine this into a single search, but the important part is the by clause.

As you have it written:

 host=xyz* index=my_index NOT(bot) earliest=-1d@d latest=-0d@d | eval searchid="Today" | stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404 by searchid | append [ search index=my_index host=pdap* index=os_web NOT(bot) earliest=-2d@d latest=-1d@d |eval searchid="Yesterday" | stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404 by searchid]

As I would write it combined:

index=my_index host=pdap* index=os_web NOT(bot) earliest=-2d@d  latest=-0d@d |eval searchid=if(_time>relative_time(now(),"-1d@d"),"Today", "Yesterday")| stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404 by searchid

[vivekb]

Thanks much. Perfect answer similar to what @sundareshr has posted. Since I can accept only one answer, I picked the first one. Thanks again.

[sundareshr · Accepted solution]

Try this

host=xyz* index=my_index NOT(bot) earliest=-2d@d latest=-0d@d 
| eval searchid=if(_time<relative_time(now(), "-1d@d"), "Today", "Yesterday")
| stats count(eval(searchmatch("Exception"))) as Exceptions count(eval(searchmatch("Error"))) as Errors count(eval(searchmatch("404"))) as 404 by searchid

[vivekb]

Thanks a bunch. Saved my day.

[vivekb]

Thanks again. @sundeshOne extension to the query - Since relative_time function accepts two arguments -
How do I extrapolate to last 7 days?

E.g.
Today
Yesterday
2 Days Prior
3 Days Prior

Thanks.

[sundareshr]

You could do searchid=round((now()-_time)/86400, 0)." days"