Dashboards & Visualizations

How to combine two charts into one?

DEADBEEF
Path Finder

I have two charts that work as expected when separate, but I'm having  a hard time combining them into one chart as they have different search criteria (but from the same index/source) so search2 ends up being wrong when using the criteria from search 1.  I tried combining using the chart overlays but I couldn't get it to work.  Any pointers would be very much appreciated!

search 1 - last 30 days

 

 

index=foo source=bar criticality=high state=open
| bin _time span=1d
| stats count AS warnings by _time

 

 

search 2 - last 30 days

 

 

index=foo source=bar
| bin _time span=1d
| stats dc(accountId) AS Accounts by _time

 

 

 

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try:

index=foo source=bar | eval warning=if(criticality="high" AND state="open",1,0) | bin _time span=1d | stats dc(accountId) AS Accounts sum(warning) as warnings by _time

View solution in original post

DEADBEEF
Path Finder

@somesoni2 you've helped me many times over the years.  Thank you for being a part of this community.  The answer worked like a charm.   I'm going to keep that eval trick in my pocket!

0 Karma

somesoni2
Revered Legend

Give this a try:

index=foo source=bar | eval warning=if(criticality="high" AND state="open",1,0) | bin _time span=1d | stats dc(accountId) AS Accounts sum(warning) as warnings by _time
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...

Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass

Hello Splunkers,  We’re excited to kick off a Splunk Dashboard contest! We know that dashboards are a primary ...

May 2026 Splunk Expert Sessions: Security & Observability

Level Up Your Operations: May 2026 Splunk Expert Sessions Whether you are refining your security posture or ...