<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic How to overlay line chart on a timerange column chart?? in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-overlay-line-chart-on-a-timerange-column-chart/m-p/504556#M140898</link>
    <description>&lt;P&gt;Hey everyone. I am a newbie to splunk and i am stuck at this problem. So i have a column chart which shows data for a time range between two dates ex. 6/9/2020-6/23/2020 like in the pic below.&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20200616_124035__01__01.jpg" style="width: 4000px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/9198i02C76964CF1F3D4E/image-size/medium?v=v2&amp;amp;px=400" role="button" title="IMG_20200616_124035__01__01.jpg" alt="IMG_20200616_124035__01__01.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;So the query i used for this is&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;Index=main sourcetype = timeline | eval dates= beginning_date."-".ending_date | stats count by dates, target | xyseries dates target count&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;So now what i want is...if i append another search to this which contains data on 6/15/2020, It is treating 6/15/2020 as a seperate date. Like this&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20200616_152129__01.jpg" style="width: 4000px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/9200i1E4ECE2D4774AF02/image-size/medium?v=v2&amp;amp;px=400" role="button" title="IMG_20200616_152129__01.jpg" alt="IMG_20200616_152129__01.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;In the above image i want the line chart on date 2020-06-15 to go on to top of the column chart as that date lies in between 2020-06-09&amp;nbsp; &amp;nbsp;-&amp;nbsp; &amp;nbsp;2020-06-23(changed format of time).i want to overlay line chart on top of column chart.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Here these are the fields i used&lt;/P&gt;&lt;P&gt;beginning date.&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Ending date&lt;/P&gt;&lt;P&gt;6/9/2020.&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;6/23/2020&lt;/P&gt;&lt;P&gt;And i want to create the query with these fields and not _time.&lt;/P&gt;&lt;P&gt;Any help is appreciated and if there is anything u didn't understand in my question plz let me know. Thanks a lot.&lt;/P&gt;</description>
    <pubDate>Tue, 16 Jun 2020 10:00:54 GMT</pubDate>
    <dc:creator>nikitha15</dc:creator>
    <dc:date>2020-06-16T10:00:54Z</dc:date>
    <item>
      <title>How to overlay line chart on a timerange column chart??</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-overlay-line-chart-on-a-timerange-column-chart/m-p/504556#M140898</link>
      <description>&lt;P&gt;Hey everyone. I am a newbie to splunk and i am stuck at this problem. So i have a column chart which shows data for a time range between two dates ex. 6/9/2020-6/23/2020 like in the pic below.&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20200616_124035__01__01.jpg" style="width: 4000px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/9198i02C76964CF1F3D4E/image-size/medium?v=v2&amp;amp;px=400" role="button" title="IMG_20200616_124035__01__01.jpg" alt="IMG_20200616_124035__01__01.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;So the query i used for this is&amp;nbsp;&lt;/P&gt;&lt;P&gt;&lt;STRONG&gt;Index=main sourcetype = timeline | eval dates= beginning_date."-".ending_date | stats count by dates, target | xyseries dates target count&lt;/STRONG&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;So now what i want is...if i append another search to this which contains data on 6/15/2020, It is treating 6/15/2020 as a seperate date. Like this&lt;/P&gt;&lt;P&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="IMG_20200616_152129__01.jpg" style="width: 4000px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/9200i1E4ECE2D4774AF02/image-size/medium?v=v2&amp;amp;px=400" role="button" title="IMG_20200616_152129__01.jpg" alt="IMG_20200616_152129__01.jpg" /&gt;&lt;/span&gt;&lt;/P&gt;&lt;P&gt;In the above image i want the line chart on date 2020-06-15 to go on to top of the column chart as that date lies in between 2020-06-09&amp;nbsp; &amp;nbsp;-&amp;nbsp; &amp;nbsp;2020-06-23(changed format of time).i want to overlay line chart on top of column chart.&amp;nbsp;&lt;/P&gt;&lt;P&gt;Here these are the fields i used&lt;/P&gt;&lt;P&gt;beginning date.&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; Ending date&lt;/P&gt;&lt;P&gt;6/9/2020.&amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp; &amp;nbsp;6/23/2020&lt;/P&gt;&lt;P&gt;And i want to create the query with these fields and not _time.&lt;/P&gt;&lt;P&gt;Any help is appreciated and if there is anything u didn't understand in my question plz let me know. Thanks a lot.&lt;/P&gt;</description>
      <pubDate>Tue, 16 Jun 2020 10:00:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-overlay-line-chart-on-a-timerange-column-chart/m-p/504556#M140898</guid>
      <dc:creator>nikitha15</dc:creator>
      <dc:date>2020-06-16T10:00:54Z</dc:date>
    </item>
  </channel>
</rss>

