https://community.splunk.com/t5/Splunk-Search/How-to-overlay-two-searches-on-the-same-graph/m-p/183113#M52724 <P>Hi mark.chuman,</P> <P>take a look at this answer here <A href="http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html">http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html</A> this will give you an idea how this could be done.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Mon, 27 Oct 2014 13:22:24 GMT MuS 2014-10-27T13:22:24Z https://community.splunk.com/t5/Splunk-Search/How-to-overlay-two-searches-on-the-same-graph/m-p/183112#M52723 <P>I have these two searches and am trying to figure out the best way to overlay them both on the same graph:</P> <P>search 1</P> <PRE><CODE>index=distributed sourcetype=vcenter_* "[Vdb::GetConnection] Failed to obtain connection" OR "SHUTDOWN is in progress." sourcetype=vcenter_vpxdlogs host=eivc2*vwin | timechart count by host </CODE></PRE> <P>search 2</P> <PRE><CODE>index=distributed sourcetype=vcenter_* sourcetype=vcenter_vpxdlogs "Starting VMware VirtualCenter" host=eivc2*vwin | timechart count by host </CODE></PRE> <P>Thanks!</P> Mon, 27 Oct 2014 13:10:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overlay-two-searches-on-the-same-graph/m-p/183112#M52723 mark_chuman 2014-10-27T13:10:03Z https://community.splunk.com/t5/Splunk-Search/How-to-overlay-two-searches-on-the-same-graph/m-p/183113#M52724 <P>Hi mark.chuman,</P> <P>take a look at this answer here <A href="http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html">http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html</A> this will give you an idea how this could be done.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Mon, 27 Oct 2014 13:22:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overlay-two-searches-on-the-same-graph/m-p/183113#M52724 MuS 2014-10-27T13:22:24Z https://community.splunk.com/t5/Splunk-Search/How-to-overlay-two-searches-on-the-same-graph/m-p/183114#M52725 <P>As MuS says (definitely check out the awesome answer he links to), the search is the key. On the visualization side, there are a couple of examples in the docs: <A href="http://docs.splunk.com/Documentation/Splunk/6.1.4/Viz/Chartcontrols#Chart_overlay">Chart overlay</A></P> Mon, 27 Oct 2014 19:28:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-overlay-two-searches-on-the-same-graph/m-p/183114#M52725 ChrisG 2014-10-27T19:28:31Z