https://community.splunk.com/t5/Splunk-Search/Merge-two-line-charts/m-p/296301#M89400 <P>Thanks ! This works!</P> Thu, 16 Nov 2017 22:45:45 GMT super_virus 2017-11-16T22:45:45Z https://community.splunk.com/t5/Splunk-Search/Merge-two-line-charts/m-p/296299#M89398 <P>Hi ,</P> <P>Very new to splunk.<BR /> I need to search a index with two strings example:</P> <P>"ABC1"<BR /> "XVZ2"</P> <P>And create a line graphs of the count of time we found those two strings. I have two searches that do this for each string and create separate graphs .</P> <P>Graph 1 : index=index_name host="host1" OR "host2" "ABC1" | timechart count(_raw) as error span=1h <BR /> GRAPH 2 : index=index_name host="host1" OR "host2" "XVZ2"| timechart count(_raw) as warning span=1h </P> <P>How can i merge these graphs? I need to have one chart with two lines (one for error and other for warning ) representing the above searches . Please help.</P> Tue, 29 Sep 2020 16:53:15 GMT https://community.splunk.com/t5/Splunk-Search/Merge-two-line-charts/m-p/296299#M89398 super_virus 2020-09-29T16:53:15Z https://community.splunk.com/t5/Splunk-Search/Merge-two-line-charts/m-p/296300#M89399 <P>Try like this</P> <PRE><CODE>index=index_name (host="host1" OR "host2") "ABC1" OR "XVZ2" | eval error=if(searchmatch("ABC1"),1,0) | eval warning=if(searchmatch( "XVZ2"),1,0) | timechart span=1h sum(error) as error sum(warning) as warning </CODE></PRE> Thu, 16 Nov 2017 22:20:37 GMT https://community.splunk.com/t5/Splunk-Search/Merge-two-line-charts/m-p/296300#M89399 somesoni2 2017-11-16T22:20:37Z https://community.splunk.com/t5/Splunk-Search/Merge-two-line-charts/m-p/296301#M89400 <P>Thanks ! This works!</P> Thu, 16 Nov 2017 22:45:45 GMT https://community.splunk.com/t5/Splunk-Search/Merge-two-line-charts/m-p/296301#M89400 super_virus 2017-11-16T22:45:45Z