https://community.splunk.com/t5/Dashboards-Visualizations/How-to-timechart-multiple-functions-in-one-search/m-p/241786#M43276 <P>great!<BR /> Thank you!</P> Sun, 22 Jan 2017 06:41:21 GMT naty 2017-01-22T06:41:21Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-timechart-multiple-functions-in-one-search/m-p/241784#M43274 <P>Hi,</P> <P>i want to do a timechart with multiple functions, for example - timechart span=1h max(blabla) by boo1 avg(blabla) by boo1</P> <P>this is my search:</P> <P>index=myind source=mysrc | timechart span=1h avg(CPU_USAGE) by Process_Name</P> <P>CPU_USAGE and Process_Name are made up, just so i can show the split-by clause.</P> <P>what i would like to do is something like this:<BR /> index=myind source=mysrc | timechart span=1h avg(CPU_USAGE) by Process_Name, max(CPU_USAGE) by Process_Name</P> <P>so the idea is to show on the same panel both the average &amp; the maximum of the CPU_USAGE for each process name.<BR /> because there can only be one split-by clause, the above search won't help.</P> <P>i tried using this:<BR /> index=myind source=mysrc | timechart span=1h avg(CPU_USAGE) by Process_Name | appendcols [search index=myind source=mysrc | timechart span=1h max(CPU_USAGE) by Process_Name]</P> <P>but that's a heavy search that is not really good, i am doing twice the search for the same data <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P>help!</P> Tue, 29 Sep 2020 12:28:17 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-timechart-multiple-functions-in-one-search/m-p/241784#M43274 naty 2020-09-29T12:28:17Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-timechart-multiple-functions-in-one-search/m-p/241785#M43275 <P>index=myind source=mysrc | timechart span=1h avg(CPU_USAGE) max(CPU_USAGE) by Process_Name </P> Tue, 29 Sep 2020 12:28:23 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-timechart-multiple-functions-in-one-search/m-p/241785#M43275 andrey2007 2020-09-29T12:28:23Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-timechart-multiple-functions-in-one-search/m-p/241786#M43276 <P>great!<BR /> Thank you!</P> Sun, 22 Jan 2017 06:41:21 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-timechart-multiple-functions-in-one-search/m-p/241786#M43276 naty 2017-01-22T06:41:21Z