topic Re: Merging two chart together in Splunk Search

Merging two chart together

carrotball — Mon, 28 Sep 2020 13:28:31 GMT

Hi,

I'm currently have 2 charts, one is the number of sms sent during office hour, the other is after office hour. is there any way i can merge the 2 search queries as one?

sourcetype="CAS-v3" sender!="CHI" sender!="PNSMS" dept=TSID recipient="HEAT*" | where date_hour>8 and date_hour<19 | timechart span="month" count by recipient

sourcetype="CAS-v3" sender!="CHI" sender!="PNSMS" dept=TSID recipient="HEAT*" | where date_hour<8 or date_hour>19 | timechart span="month" count by recipient

Re: Merging two chart together

Ayn — Fri, 08 Mar 2013 08:10:51 GMT

sourcetype="CAS-v3" sender!="CHI" sender!="PNSMS" dept=TSID recipient="HEAT*" | eval hour_type=case(date_hour>=8 AND date_hour<19,"office hours",date_hour<8 OR date_hour>=19,"outside office hours") |timechart span=1mon count by recipient,hour_type

Re: Merging two chart together

MuS — Fri, 08 Mar 2013 09:54:12 GMT

hmmmmm I must be doing something wrong here Ayn, but I get an 'Error in 'timechart' command: The argument 'hour_type' is invalid.' if I use your search?

Re: Merging two chart together

MuS — Fri, 08 Mar 2013 10:31:49 GMT

I wonder if this will work, because 'timechart' can only take one 'split by' series, 'chart' can take two.

So for timechart it would be:
...| timechart span=1mon count(recipient) by hour_type

and for chart it would be:
...| chart count by recipient,hour_type

on the other hand, count(recipient) will count all events that have a recipient and not events for each recipient....

Re: Merging two chart together

carrotball — Mon, 11 Mar 2013 06:04:18 GMT

hmmmmm
thanks for the help, the second one works but cant display it by month...

wondering if i can tune it more. time to go read lol