topic Re: Add two lines in a chart in Splunk Search

Add two lines in a chart

wasifchowdhury — Fri, 10 Sep 2021 20:33:37 GMT

I have this query and I want to add another data series/line to this chart. How can I do it?

index="eniq_voice"
|where localDn="ManagedElement=TO5CSCF01"
|bucket _time span=15m
|stats max(CPULoad_Total) as CPULoad_Total by localDn _time
|timechart max(CPULoad_Total) as CPULoad_Total

I want to add this to the query with a linechart:
|stats max(CPULoad_Max) as CPULoad_Max by localDn _time
|timechart max(CPULoad_Max) as CPULoad_Max by localDn _time

Re: Add two lines in a chart

ITWhisperer — Fri, 10 Sep 2021 22:44:52 GMT

Does this give you what you want?

index="eniq_voice" |where localDn="ManagedElement=TO5CSCF01" |bucket _time span=15m |stats max(CPULoad_Total) as CPULoad_Total max(CPULoad_Max) as CPULoad_Max by localDn _time |timechart max(CPULoad_Total) as CPULoad_Total max(CPULoad_Max) as CPULoad_Max

Re: Add two lines in a chart

Siddharth — Sun, 12 Sep 2021 00:25:34 GMT

Hi

index="eniq_voice"
|where localDn="ManagedElement=TO5CSCF01"
|bucket _time span=15m
|stats max(CPULoad_Total) as CPULoad_Total by localDn _time
|timechart max(CPULoad_Total) as CPULoad_Total max(CPULoad_Max) as CPULoad_Max

This should help . Basically you can add as much as line you want see example below

Re: Add two lines in a chart

wasifchowdhury — Mon, 13 Sep 2021 16:04:18 GMT

Sorry, it doesnt. I dont get any results.