Dashboards & Visualizations
Highlighted

2 searches 2 sources one chart???

Explorer

hello all,

i have 2 searches each with its own source, and i need to time chart that over 24 hrs in single chart? i cant figure out how to do that...

here are the searches: Search1: host="SOURCE1" PROCESSFLAG=SUCCESS| timechart span="1h" count by PROCESSFLAG

Search2: host="SOURCE2" NOT ORDER_STATUS ORDER_STATUS="Entered" OR ORDER_STATUS="Booked" | timechart span="1h" count by ORDER_STATUS

Thanks Ashish

Tags (1)
0 Karma
Highlighted

Re: 2 searches 2 sources one chart???

Splunk Employee
Splunk Employee

I think the following should give you what you want.

host="SOURCE1" PROCESSFLAG=SUCCESS
   | timechart span="1h" count by PROCESSFLAG 
   | join _time 
     [search host="SOURCE2" NOT ORDER_STATUS ORDER_STATUS="Entered" OR ORDER_STATUS="Booked"  
        | timechart span="1h" count by ORDER_STATUS
     ]

Let me know if that works out.

View solution in original post

0 Karma
Highlighted

Re: 2 searches 2 sources one chart???

Explorer

Wow this is cool..
thanks

0 Karma