show results from two splunk queries into one
10,076
Solution 1
You can join the two queries by using :
|
So your query can look like this:
{firstQuery} as countUS| {secondQuery} as countTotal | eval perc=countUS/countTotal
Solution 2
You can use a conditional to count those from US
Example query:
index=data | timechart dc(user) as dc_user, dc(eval(if(geo=US,user,NULL))) as us_user | eval perc_us=round(us_user/dc_user*100,2) | table _time, perc_us
Alternatively you can use the SPL join command but that would be less efficient as it would have to read the data twice and join the results.
Related videos on Youtube
05 : 20
Basic Searching in Splunk
11 : 49
"Splunk Enterprise 6 Basic Search"
16 : 24
Splunk - Alert Action - Upload Search Results to AWS S3
09 : 04
Splunk 101: Basic Search
24 : 13
Splunk Commands : "join" vs "map" vs "selfjoin" command detail explanation
26 : 39
Splunk Commands | Splunk stats | Splunk eventstats
08 : 02
Splunk Joins - Splunk Left Join - Splunk Inner Join - Splunk Outer Join
02 : 27
How to Filter splunk results using results of another splunk query | splunk scenarios tutorial
02 : 26
How to append two queries and get single output in splunk | splunk scenarios tutorial
Author by
A-D
Front end engineer working in the enterprise world and solving their problems. Everyday is a new day and I am learning new things. Building apps using Angularjs, ReactJS, HTML, Javascript and CSS.
Updated on September 16, 2022Comments
-
A-D over 1 year
I have two separate splunk queries: 1st Query : Outputs unique user count in last 24 hours 2nd Query : Outputs unique users count in last 24 hours in geo = US
I want to create a timechart that will show , a line chart with % of user everyday from US.
How can this be achieved.
-
Jerry Jeremiah almost 3 yearsI was thinking append as well. You should probably say "for example, you could use append:" or something similar so it is obvious what your example is an example of - the reason I suggest this is that the word "append" in the preformatted text doesn't show up on my screen - I have to actually scroll to the right to see it.
