topic Merging TWO Timecharts overlay-One on Top of One Another in Splunk Search

Merging TWO Timecharts overlay-One on Top of One Another

zd00191 — Fri, 31 Jul 2015 21:26:53 GMT

I have the following search.

index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91"  System="*" eventtype=autosys_initiated_jobs |timechart span=1d count(JOB_NAME) as Count |append [search index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91"  System="*" eventtype=autosys_initiated_jobs earliest=07/12/2015:0:0:0 latest=07/27/2015:0:0:0 |timechart span=1d count(JOB_NAME) |rename count(JOB_NAME) as "Close-Freeze Period" |fields "Close-Freeze Period"]

I want the subsearch timechart to be an overlay on top of the first timechart. At the moment, the two timecharts are displayed next to one another. I would like them to be on top of one another. Please help! Thanks!

Re: Merging TWO Timecharts overlay-One on Top of One Another

jnussbaum_splun — Fri, 31 Jul 2015 22:05:12 GMT

try - index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" System="*" eventtype=autosys_initiated_jobs |timechart span=1d count(JOB_NAME) as Count |append [search index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" System="*" eventtype=autosys_initiated_jobs earliest=07/12/2015:0:0:0 latest=07/27/2015:0:0:0 |timechart span=1d count(JOB_NAME) |rename count(JOB_NAME) as "Close-Freeze Period" |fields "Close-Freeze Period"] | timechart first(*) as *

Re: Merging TWO Timecharts overlay-One on Top of One Another

woodcock — Fri, 31 Jul 2015 22:09:29 GMT

This should work:

index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91"  System="*" eventtype=autosys_initiated_jobs | timechart span=1d count(JOB_NAME) as Count | appendcols [search index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" System="*" eventtype=autosys_initiated_jobs earliest=07/12/2015:0:0:0 latest=07/27/2015:0:0:0 | timechart span=1d count(JOB_NAME) AS "Close-Freeze Period" | fields "Close-Freeze Period"]

Re: Merging TWO Timecharts overlay-One on Top of One Another

koshyk — Fri, 13 Sep 2019 10:27:38 GMT

Just making the answer generic

<your_query_with_timestamp>| timechart span=1h avg(datapoint1)
| appendcols [ | search <your_query_with_timestamp> | timechart span=1h avg(datapoint2)]

Things to note
1. timechart "span" should be similar
2. timezone of data should be similar

Re: Merging TWO Timecharts overlay-One on Top of One Another

Yepeza — Thu, 11 Feb 2021 03:07:19 GMT

Really help out! Thanks!