- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How to include 2 search in one results?
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have one problem here.
I need to create a search with 2 groups, and create a chart with result.
Example, my search :
index=inc_ group="Ti" OR group="Support" OR group="admin" OR group="helpdesk" | stats count(eval(match(group,"TI,Support"))) AS Operation , count(eval(match(Grupo,"admin,helpdesk"))) AS Administrative
How create a graph with this query?
I try using | timechart count by Operation|Administrative but i not have success
Help 😞
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can split your search in 2 searches and append them together. Try something like that (after correcting your typos):
index=inc_ group="Ti" OR group="Support" OR group="admin" OR group="helpdesk" | stats count(eval(match(group,"TI,Support"))) AS "Operation" by _time | append [search index=inc_ group="admin" OR group="helpdesk" | stats count(eval(match(group,"admin,helpdesk"))) AS "Administrative" by _time] | stats values("Operation"), values("Administrative") by _time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
So did the search gave you the result?
|Timechart Operation,Administrative
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry linu1988!
It's a error in my digitation
The search is:
count(eval(match(group,"TI,Support"))) AS Operation , count(eval(match(group,"admin,helpdesk"))) AS Administrative
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can split your search in 2 searches and append them together. Try something like that (after correcting your typos):
index=inc_ group="Ti" OR group="Support" OR group="admin" OR group="helpdesk" | stats count(eval(match(group,"TI,Support"))) AS "Operation" by _time | append [search index=inc_ group="admin" OR group="helpdesk" | stats count(eval(match(group,"admin,helpdesk"))) AS "Administrative" by _time] | stats values("Operation"), values("Administrative") by _time
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can't test it right now, but if you remove "by _time" everywhere in the search, it should give you the count for Operation and the count Administrative, so that you just have to create a report and select pie chart.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thx bro! Perfect!!
I have one more question about this topic, how to add values in one pie graph? It's possible? Ex : Operation vs Administrative
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
count(eval(match(Grupo,"admin,helpdesk"))) in the part
"Grupo" is a field or a typo error in the search?
And i suppose Operation/Administrative are fields!!! You should put |Timrchart Operation,Administrative
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
Splunk APM: New Product Features + Community Office Hours Recap!
Index This | Forward, I’m heavy; backward, I’m not. What am I?
