https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67088#M16761 <P>Just tried this, provided the legends have the same text the colors should be the same in the 2 charts. The only alignment issues are because the widths of the text on the right hand side axis could be different ( which is easily remedied by moving the axis to the right )</P> <P>The bigger problem would be having null values for some of the fields which would prevent the 'null columns being plotted, but you can work around this with something like :</P> <PRE><CODE>chart sum(eval(if(isnotnull(TransactionValue),TransactionValue,0))) as TransactionValue over BusinessDay by TransactionType </CODE></PRE> <P>Why aren't they lining up for you ?</P> Wed, 19 Dec 2012 15:09:53 GMT jonuwz 2012-12-19T15:09:53Z https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67085#M16758 <P>Hello,</P> <P>I have a search like : total value of each transaction type for each business day</P> <PRE><CODE>host="test1" sourcetype="ObjTransaction" | chart sum(TransactionValue) over BusinessDay by TransactionType </CODE></PRE> <P>and another is number of events of each transaction type for each business day</P> <PRE><CODE>host="test1" sourcetype="ObjTransaction" | chart count as number over BusinessDay by TransactionType </CODE></PRE> <P>How can i display 2 colunm chars such that they have same vertical alignment basing on BusinessDay( time with unit is day) and have the same color for each TransactionType ?</P> <P>For ex: In column chart of number of events of each business day,on the 10/12/2012: there are 2 transactions A and B</P> <P>A has blue color and its number of events is 10, B has red color and its number of events is 20</P> <P>In column chart of total value of each businessday, similarly, A, B have the same color as previous chart, means A in blue color with its value is 102$, et B in red color with its value = 80$</P> Tue, 18 Dec 2012 15:52:45 GMT https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67085#M16758 sieutruc 2012-12-18T15:52:45Z https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67086#M16759 <P>I'm not sure I understand you, but would:</P> <PRE><CODE>host="test1" sourcetype="ObjTransaction" | chart count as number, sum(TransactionValue) by BusinessDay,TransactionType </CODE></PRE> <P>work for you?</P> Tue, 18 Dec 2012 19:15:55 GMT https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67086#M16759 gkanapathy 2012-12-18T19:15:55Z https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67087#M16760 <P>No, what i want is 2 column charts that have the same vertical alignment, so that i can see clearly how many event of one particular transaction type in one specific day, and its sum value corresponding.</P> Tue, 18 Dec 2012 21:46:20 GMT https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67087#M16760 sieutruc 2012-12-18T21:46:20Z https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67088#M16761 <P>Just tried this, provided the legends have the same text the colors should be the same in the 2 charts. The only alignment issues are because the widths of the text on the right hand side axis could be different ( which is easily remedied by moving the axis to the right )</P> <P>The bigger problem would be having null values for some of the fields which would prevent the 'null columns being plotted, but you can work around this with something like :</P> <PRE><CODE>chart sum(eval(if(isnotnull(TransactionValue),TransactionValue,0))) as TransactionValue over BusinessDay by TransactionType </CODE></PRE> <P>Why aren't they lining up for you ?</P> Wed, 19 Dec 2012 15:09:53 GMT https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67088#M16761 jonuwz 2012-12-19T15:09:53Z https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67089#M16762 <P>You can see clearly what are not lining up in 2 figures. The first is the Y axis' scale value and second is number of transaction types for each day, especially on 31/10/2012, there is no event 10 in the first figure. So how to fix X axis width for their vertical alignment, let transaction types be appearing similarly in 2 figures? </P> <P><IMG src="http://splunk-base.splunk.com//storage/chart.bmp" alt="alt text" /></P> Thu, 20 Dec 2012 13:11:44 GMT https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67089#M16762 sieutruc 2012-12-20T13:11:44Z https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67090#M16763 <P>It's good for their color in 2 figure as Splunk automatically detects them, but for alignment, you can see my extra added information with figures above</P> Thu, 20 Dec 2012 13:17:00 GMT https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67090#M16763 sieutruc 2012-12-20T13:17:00Z https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67091#M16764 <P>try doing <CODE>chart limit=0 ...</CODE> chart picks the top 10 by default, so if the top 10 are different in each graph, they wont match (some will be missing)</P> Thu, 20 Dec 2012 17:04:42 GMT https://community.splunk.com/t5/Splunk-Search/Display-2-charts-at-the-same-timing-alignment-and-with-the-same/m-p/67091#M16764 jonuwz 2012-12-20T17:04:42Z