topic Re: How do I chart 2 searches on one chart? in Splunk Search

How do I chart 2 searches on one chart?

afamoyib — Thu, 08 Mar 2018 19:53:45 GMT

Searches

index=nix sourcetype=cpu host="host a"  CPU="all" | eval Percent_CPU_Load = 100 - pctIdle | timechart limit=0 max(Percent_CPU_Load) by host

index=nix source=vmstat sourcetype=vmstat tag=memory host="host a"  | timechart limit=0 max(memUsedPct) by host

Re: How do I chart 2 searches on one chart?

livehybrid — Thu, 08 Mar 2018 20:15:20 GMT

Here is a simpler example of how this might work:
index=* | timechart count by source | append [search index=* | timechart count by sourcetype]

For your search this might work:

index=nix sourcetype=cpu host="host a" CPU="all" | eval Percent_CPU_Load = 100 - pctIdle | timechart limit=0 max(Percent_CPU_Load) by host | append [search index=nix source=vmstat sourcetype=vmstat tag=memory host="host a" | timechart limit=0 max(memUsedPct) by host]

Re: How do I chart 2 searches on one chart?

afamoyib — Thu, 08 Mar 2018 20:25:51 GMT

It does not seem to work. It is displaying 3 charts instead of 2

Re: How do I chart 2 searches on one chart?

livehybrid — Thu, 08 Mar 2018 20:51:06 GMT

Are you able to upload a picture so I can see what it looks like?
Thanks