https://community.splunk.com/t5/Splunk-Search/How-to-merge-3-timecharts-into-one/m-p/150563#M42188 <P>Works great, thank you!!</P> Mon, 21 Jul 2014 13:38:39 GMT larsxschneider 2014-07-21T13:38:39Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-3-timecharts-into-one/m-p/150561#M42186 <P>Hi,</P> <P>I have three slightly different queries on the same data set.</P> <P>(1) <BR /> general_attribute="foo" special_attribute="A" | timechart span="1d" dc(user)</P> <P>(2) <BR /> general_attribute="foo" special_attribute="B" | timechart span="1d" dc(user)</P> <P>(3) <BR /> general_attribute="foo" special_attribute="C" | timechart span="1d" dc(user)</P> <P>I would like to see all three of them in one chart. E.g a bar chart with 3 bars per day.<BR /> Is this possible with Splunk?</P> <P>Thanks,<BR /> Lars</P> Mon, 28 Sep 2020 17:07:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-3-timecharts-into-one/m-p/150561#M42186 larsxschneider 2020-09-28T17:07:55Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-3-timecharts-into-one/m-p/150562#M42187 <P>Sure.</P> <PRE><CODE> general_attribute="foo" (special_attribute="A" OR special_attribute="B" OR special_attribute="C") | timechart span="1d" dc(user) by special_attribute </CODE></PRE> <P>Common visualizations for this are (stacked) columns, (stacked) area, or line charts depending on the meaning of the data and the viewer.</P> Mon, 21 Jul 2014 12:46:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-3-timecharts-into-one/m-p/150562#M42187 martin_mueller 2014-07-21T12:46:19Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-3-timecharts-into-one/m-p/150563#M42188 <P>Works great, thank you!!</P> Mon, 21 Jul 2014 13:38:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-3-timecharts-into-one/m-p/150563#M42188 larsxschneider 2014-07-21T13:38:39Z