topic Re: Combining two graphs into ONE in Dashboards & Visualizations

Combining two graphs into ONE

macadminrohit — Thu, 19 Apr 2018 23:51:18 GMT

Hi Have the below Searches , most of which are common, only different is i am doing a regex in one of them to compare the string with a number. I am not sure if i can use a streamstats to combine two searches together to avoid running the search twice. Basically i want to combine the two graphs into one i.e one search will give a line graph and another will give a bar graph, like an overlay. With Same x-axis i.e count .

index=servers sourcetype=xs_json Name="Server App" Version=* | bucket _time span=1h | timechart count AS HTTP_COUNT by Url useother=f usenull=f limit=50 | fillnull value=0

index=servers sourcetype=xs_json Name="Server App" Version=* | bucket _time span=1h | rex field=_raw "Response Code\",\"value\":\"(?<RespCode>\w+)\"}," | where RespCode!=200 | timechart count AS ERROR_COUNT by Url useother=f usenull=f limit=50 | fillnull value=0

Re: Combining two graphs into ONE

adonio — Fri, 20 Apr 2018 00:03:16 GMT

hello there,

you can use conditional eval in timechart as well

 index=servers sourcetype=xs_json Name="Server App" Version=* 
| bucket _time span=1h 
| rex field=_raw "Response Code\",\"value\":\"(?<RespCode>\w+)\"}," 
| timechart count(eval(RespCode>200) AS ERROR_COUNT count as HTTP_COUNT by Url useother=f usenull=f limit=50 
| fillnull value=0

hope it helps

Re: Combining two graphs into ONE

macadminrohit — Fri, 20 Apr 2018 00:34:31 GMT

Basically i dont want to combine the queries to get a single query, i want two graphs into an overlay. First query results into a bar graph and the second results into a line chart. I want those two graphs to overlay.

Re: Combining two graphs into ONE

adonio — Fri, 20 Apr 2018 00:42:48 GMT

use the chart overlay function in the viz
have it as a bar chart and then pick the field you want for chart overlay

Re: Combining two graphs into ONE

macadminrohit — Fri, 20 Apr 2018 01:49:44 GMT

Thank you so Much Adonio. It works like a champ.