how to combine time chart and bar chart together

cheriemilk — Thu, 21 Oct 2021 06:06:45 GMT

Hi team,

1. I have first query which return me below chart

<baseQuery> |timechart span=4w count(ACT) as countOfOpenSession, distinct_count(UID) as countOfUserID, distinct_count(CMN) as countOfCustomer

2. then I have second query which return me below table and chart, which is for getting the CMN value which has highest hit value per month.

<baseQuery> | stats count(ACT) as hit by date_month CMN | eventstats max(hit) as maxhit by date_month | where hit=maxhit | fields - maxhit

Expected Chart I want to get from splunk search:

1. combine the two queries into one. (by the way, baseQuery for the two queries in my scenario are same.)

2. combine the timeline chart and bar chart into one chart .

3. From the combined chart->on the bars, to display both CMN(customer Name) and hit count

Here is an example chart I want(similar to below)

how to edit the query and format to achieve the expected chart?

topic how to combine time chart and bar chart together in Splunk Search