https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-overlay-one-chart-on-top-of-the-other/m-p/484080#M31711 <P>Depending on what i was trying to achieve, I'd tend to do something like this.</P> <PRE><CODE> index=_internal connection | eval cooked=case(match(_raw,"cooked"),1) | timechart count as total sum(cooked) as cooked by splunk_server </CODE></PRE> Tue, 28 Apr 2020 20:25:29 GMT DalJeanis 2020-04-28T20:25:29Z https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-overlay-one-chart-on-top-of-the-other/m-p/484079#M31710 <P>I have the following two queries -</P> <PRE><CODE>index=_internal connection | timechart count by splunk_server index=_internal cooked connection | timechart count by splunk_server </CODE></PRE> <P>How can I overlay them?</P> Tue, 28 Apr 2020 19:10:50 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-overlay-one-chart-on-top-of-the-other/m-p/484079#M31710 danielbb 2020-04-28T19:10:50Z https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-overlay-one-chart-on-top-of-the-other/m-p/484080#M31711 <P>Depending on what i was trying to achieve, I'd tend to do something like this.</P> <PRE><CODE> index=_internal connection | eval cooked=case(match(_raw,"cooked"),1) | timechart count as total sum(cooked) as cooked by splunk_server </CODE></PRE> Tue, 28 Apr 2020 20:25:29 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-can-I-overlay-one-chart-on-top-of-the-other/m-p/484080#M31711 DalJeanis 2020-04-28T20:25:29Z