Dashboards & Visualizations

Hi, I currently have two quires and I have separate graph for each one of them for over a week data, But I want to merge both the graphs as line chart or Column chart into a single graph

divakarr996
New Member

Query 1 -
host="fmvmprdpreset1" OR host="fmvmprdpreset2" OR host="egvmprdpreset1" sourcetype=passreset (("Reset" AND "password successfully") OR "ACDB was reset successfully" OR "ResetGappsPassword successfully" OR "Get recovery key successfully") OR ("The password doesnt comply history requirement" OR ("Reset" AND "password failed") OR "ACDB was failed to reset" OR "ResetGappsPassword failed" OR ("Reset" AND "faceless failed") OR "Get recovery key failed") earliest=-7d@d
|top limit=12 date_wday|sort date_wday

Query 2 -
host="fmvmprdpreset1" OR host="fmvmprdpreset2" OR host="egvmprdpreset1" sourcetype=passreset (("Reset" AND "password successfully") OR "ACDB was reset successfully" OR "ResetGappsPassword successfully" OR "Get recovery key successfully") earliest=-7d@d|top limit=12 date_wday|sort date_wday

alt text

Please help me to merge these two graphs into a single graph over a Week data

Thank you in advance

0 Karma

to4kawa
Ultra Champion
host="fmvmprdpreset1" OR host="fmvmprdpreset2" OR host="egvmprdpreset1" sourcetype=passreset (("Reset" AND "password successfully") OR "ACDB was reset successfully" OR "ResetGappsPassword successfully" OR "Get recovery key successfully") OR ("The password doesnt comply history requirement" OR ("Reset" AND "password failed") OR "ACDB was failed to reset" OR "ResetGappsPassword failed" OR ("Reset" AND "faceless failed") OR "Get recovery key failed") earliest=-7d@d
|chart limit=0 count(eval(searchmatch("successfully"))) as successful count as total by date_wday
| sort date_wday

hi, @divakarr996
how about this?

0 Karma

divakarr996
New Member

Thank you so much for this, it worked 🙂

0 Karma

to4kawa
Ultra Champion

I see. please accept my answer.

0 Karma
Get Updates on the Splunk Community!

Splunk Search APIを使えば調査過程が残せます

   このゲストブログは、JCOM株式会社の情報セキュリティ本部・専任部長である渡辺慎太郎氏によって執筆されました。 Note: This article is published in both Japanese ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...