topic Chart Overlay Help in Dashboards & Visualizations

Chart Overlay Help

b17gunnr — Wed, 24 Sep 2025 18:25:54 GMT

Hello folks,

I'm struggling with something that should be very basic. I have two queries to track skipped scheduled searches, the first counts the number of times a search has been skipped and the second counts how many times my individual SHC members have skipped a search. What I would like to be able to do is render my first query as a column chart and then overlay the second as a line chart. Any help would be appreciated. Thank you.

index=_internal sourcetype=scheduler status="skipped" | timechart count BY savedsearch_name useother=f usenull=f limit=0

index=_internal sourcetype=scheduler status="skipped" | timechart count BY host useother=f usenull=f limit=0

Re: Chart Overlay Help

sainag_splunk — Thu, 25 Sep 2025 00:21:04 GMT

@b17gunnr Hi!! based on what I can think of this might help?

index=_internal sourcetype=scheduler status="skipped" | timechart count BY savedsearch_name limit=5 | addtotals col=t labelfield=_time label="Total_Hosts"

Then in Visualization:

1. Chart Type: Column Chart

2. Format → Chart Overlay → On

3. Overlay field: Select Total_Hosts (or whatever the total field is named)

4. Chart Overlay type: Linear

This gives you:

- Column chart: Individual savedsearch skip counts

- Line overlay: Total volume trend across all hosts

Re: Chart Overlay Help

PrewinThomas — Thu, 25 Sep 2025 06:54:53 GMT

@b17gunnr

Try appendcols to merge the results of the two timechart searches.

This should give you savedsearch_name series and all the host series side by side.

index=_internal sourcetype=scheduler status="skipped" | timechart count BY savedsearch_name useother=f usenull=f limit=0 | appendcols [ search index=_internal sourcetype=scheduler status="skipped" | timechart count BY host useother=f usenull=f limit=0 ]

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!

Re: Chart Overlay Help

PickleRick — Thu, 25 Sep 2025 08:39:11 GMT

Wow. This is one of the very few cases where appendcols actually makes sense since due to timechart usage and aligned time ranges you should get matching results in both searches. 👍