如何在Splunk中组合两个查询？

Question

我想制作这样的时间表：

目前我使用两个查询

1.获取交易栏：

sourcetype="mysource" host="myhost" | timechart count span=1h

2.获取transaction_success列：

sourcetype="mysource" host="myhost" status="2" | timechart count span=1h

然后用Excel手动组合它们。

如何只使用一个查询搜索该数据？

Answer 1

目前我找到了如何加入查询：

sourcetype="mysource" host="myhost" | timechart count as transaction count(eval(status="2")) as transaction_success span=1h

Answer 2

我希望追加应该适合你的情况。 Query 1 append Query 2

请通过splunk中的以下帖子

https://answers.splunk.com/answers/28621/combine-2-splunk-queries.html

https://answers.splunk.com/answers/182453/how-to-combine-my-two-search-queries-using-join-or.html

https://answers.splunk.com/answers/30909/combine-two-queries-into-a-single-value.html

https://answers.splunk.com/answers/123204/how-to-combine-two-queries-into-one-without-using-eventtypes.html