https://community.splunk.com/t5/Splunk-Search/How-to-join-normalized-data-into-a-single-timechart/m-p/267561#M80490 <P>We have normalized data where multiple rows represent a single point in time, but attributes within the row represent the type. For example:</P> <PRE><CODE>time=1 metric=ReadIOPs Average=0.01 time=1 metric=WriteIOPs Average=0.02 </CODE></PRE> <P>And so forth. There are multiple metric types beyond what is shown here. We would like to have this appear in a single timechart overlayed. We can get it to work in separate time charts by simply doing:</P> <PRE><CODE>metric_name=ReadIOPs | timechart values(Average) as ReadIOPs </CODE></PRE> <P>Is it possible to get this to join both Read and Write together into a single timechart?</P> Wed, 20 Jul 2016 21:30:46 GMT kuali_brandon 2016-07-20T21:30:46Z https://community.splunk.com/t5/Splunk-Search/How-to-join-normalized-data-into-a-single-timechart/m-p/267561#M80490 <P>We have normalized data where multiple rows represent a single point in time, but attributes within the row represent the type. For example:</P> <PRE><CODE>time=1 metric=ReadIOPs Average=0.01 time=1 metric=WriteIOPs Average=0.02 </CODE></PRE> <P>And so forth. There are multiple metric types beyond what is shown here. We would like to have this appear in a single timechart overlayed. We can get it to work in separate time charts by simply doing:</P> <PRE><CODE>metric_name=ReadIOPs | timechart values(Average) as ReadIOPs </CODE></PRE> <P>Is it possible to get this to join both Read and Write together into a single timechart?</P> Wed, 20 Jul 2016 21:30:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-normalized-data-into-a-single-timechart/m-p/267561#M80490 kuali_brandon 2016-07-20T21:30:46Z https://community.splunk.com/t5/Splunk-Search/How-to-join-normalized-data-into-a-single-timechart/m-p/267562#M80491 <P>Try this</P> <PRE><CODE> metric_name=* | chart values(Average) as IOPs over _time by metric_name </CODE></PRE> Wed, 20 Jul 2016 22:41:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-normalized-data-into-a-single-timechart/m-p/267562#M80491 sundareshr 2016-07-20T22:41:18Z