topic How do I put a line graph that shows data in both indexes into one graph? in Splunk Search

How do I put a line graph that shows data in both indexes into one graph?

WXY — Wed, 19 Sep 2018 08:36:59 GMT

Hi,

I want to get a line graph with two indexes of data.

My command is index=interface sourcetype="in_t"| timechart count and index=imp sourcetype="out_t"| timechart count

What should I do?

renjith_nair — Wed, 19 Sep 2018 12:52:10 GMT

@WXY,

Try

(index=interface OR index=imp) (sourcetype="in_t" OR sourcetype="out_t")|timechart count by sourcetype

gcusello — Wed, 19 Sep 2018 13:49:06 GMT

Hi WXY
try

(index=interface sourcetype="in_t") OR (index=imp sourcetype="out_t")
| timechart count

Bye.
Giuseppe