Dashboards & Visualizations

How can I overlay one chart on top of the other?

danielbb
Motivator

I have the following two queries -

index=_internal connection  | timechart count by splunk_server

index=_internal cooked connection  | timechart count by splunk_server

How can I overlay them?

0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

Depending on what i was trying to achieve, I'd tend to do something like this.

 index=_internal connection 
 | eval cooked=case(match(_raw,"cooked"),1)
| timechart count as total sum(cooked) as cooked by splunk_server

View solution in original post

DalJeanis
SplunkTrust
SplunkTrust

Depending on what i was trying to achieve, I'd tend to do something like this.

 index=_internal connection 
 | eval cooked=case(match(_raw,"cooked"),1)
| timechart count as total sum(cooked) as cooked by splunk_server

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!