https://community.splunk.com/t5/Dashboards-Visualizations/Realtime-Combined-Search/m-p/82191#M4424 <P>In general, every subsearch finishes before the main search starts. Real-time searches do not finish, hence subsearches cannot be real-time.</P> <P>I see you have one timechart without a by field, and one timechart with by process, so I'm assuming your end result columns look something like this?</P> <PRE><CODE>_time User System process1 process2 process3 process4 </CODE></PRE> <P>?</P> <P>If that's the case you should be able to combine your two searches using OR:</P> <PRE><CODE>index=o host=x38dev10 (source=cpu OR sourcetype=ps) </CODE></PRE> <P>Then do field extractions, filtering, eval, whatnot, and give your cpu source a process:</P> <PRE><CODE>... | eval process=if(source=cpu, "CPU", process) </CODE></PRE> <P>And throw it all into one timechart by process. </P> Tue, 02 Apr 2013 17:57:35 GMT martin_mueller 2013-04-02T17:57:35Z https://community.splunk.com/t5/Dashboards-Visualizations/Realtime-Combined-Search/m-p/82190#M4423 <P>What is the best way to combine two different searches with results that can be used in a realtime dashboard? We used appendcols but found out that you cannot use it with realtime. </P> <P>We have this search right now but how would be transform it to be realtime compatable?</P> <P>index=os source=cpu host=x38dev10 | multikv fields | timechart span=30s avg(pctUser) as User, avg(pctSystem) as System | appendcols [search index="os" sourcetype="ps" host=x38dev10 | multikv fields pctCPU, COMMAND, USER | search USER=redis OR tomcat | eval process=USER."/".COMMAND | timechart span=30s avg(pctCPU) by process useother="f"]</P> <P>Thanks!</P> Tue, 02 Apr 2013 17:40:12 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Realtime-Combined-Search/m-p/82190#M4423 aaronkorn 2013-04-02T17:40:12Z https://community.splunk.com/t5/Dashboards-Visualizations/Realtime-Combined-Search/m-p/82191#M4424 <P>In general, every subsearch finishes before the main search starts. Real-time searches do not finish, hence subsearches cannot be real-time.</P> <P>I see you have one timechart without a by field, and one timechart with by process, so I'm assuming your end result columns look something like this?</P> <PRE><CODE>_time User System process1 process2 process3 process4 </CODE></PRE> <P>?</P> <P>If that's the case you should be able to combine your two searches using OR:</P> <PRE><CODE>index=o host=x38dev10 (source=cpu OR sourcetype=ps) </CODE></PRE> <P>Then do field extractions, filtering, eval, whatnot, and give your cpu source a process:</P> <PRE><CODE>... | eval process=if(source=cpu, "CPU", process) </CODE></PRE> <P>And throw it all into one timechart by process. </P> Tue, 02 Apr 2013 17:57:35 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Realtime-Combined-Search/m-p/82191#M4424 martin_mueller 2013-04-02T17:57:35Z