topic Re: Creating a line graph that displays two sets of data in Splunk Search

Creating a line graph that displays two sets of data

jmac131 — Mon, 28 Sep 2020 12:22:56 GMT

I have two searches that give me two seperate line graphs. I would like to combine these two searches so that they appear on the one graph.

These are the two searches I currently run.
sourcetype=emc-sp sp="SP A" array="Array_xxx" | timechart span=2m avg(utilization)
sourcetype=emc-sp sp="SP B" array="Array_xxx" | timechart span=2m avg(utilization)

Im no sure if this has been answered previously but I couldn't find an answer that would help.

Cheers

Re: Creating a line graph that displays two sets of data

kristian_kolb — Wed, 05 Sep 2012 11:43:37 GMT

Could this be something like it?

sourcetype=emc-sp sp="SP A" OR sp="SP B" array="Array_xxx" | timechart span=2m avg(utilization) by sp

Hope this helps,

Kristian

Re: Creating a line graph that displays two sets of data

jmac131 — Wed, 05 Sep 2012 12:04:20 GMT

Thanks, its my first day of this and that worked exactly how I needed it too. I had played with the OR but didnt know about the 'by'
Cheers.