topic Re: Combine two chart in Dashboards & Visualizations

Combine two chart

gjhaaland — Fri, 27 Oct 2023 11:50:40 GMT

Hi,

I have create two different timechart like:

Timechart1(cable connection on/off):

index=cisco_asa dest_interface=outside | timechart span=10m dc(count) by count

Timechart2(login user listed):

host=10.1.1.1 src_sg_info=* | timechart span=10m dc(src_sg_info) by src_sg_info

Individually the display is perfect, but it would be even better if we could combined into one graph with common timestamps.

I search through splunk documents, also tried different setup without success. Hope someone could help me with it 🙂

Re: Combine two chart

ITWhisperer — Fri, 27 Oct 2023 12:35:22 GMT

You can try appending the second search to the first search

Having said that using dc by the same field is only every going to give counts of 1 so your searches seem a little strange.

Re: Combine two chart

gjhaaland — Fri, 27 Oct 2023 12:51:55 GMT

Thanks 🙂 yes the search looks strange, but it's the only way out of my problems. If dest_interface=outside the cable to outside interface is connected. Not sure why, but it's perfect. I have also tried to use appendcols to combine both graphs without success. I think I must do more investigation to find out why.

Geir

Re: Combine two chart

PickleRick — Sat, 28 Oct 2023 08:22:03 GMT

appendcols just puts two sets side by side without any kind of "matching" between those sets so first row of set B will be appended to first row of set A regardless of what order of events each of those sets had.

I think you should rather simply append (not appendcols) those searches together and then do some form of stats by _time (or timechart again) to match data points from the same timestamp.