Dashboards & Visualizations

How to combine two charts into one?

DEADBEEF
Path Finder

I have two charts that work as expected when separate, but I'm having  a hard time combining them into one chart as they have different search criteria (but from the same index/source) so search2 ends up being wrong when using the criteria from search 1.  I tried combining using the chart overlays but I couldn't get it to work.  Any pointers would be very much appreciated!

search 1 - last 30 days

 

 

index=foo source=bar criticality=high state=open
| bin _time span=1d
| stats count AS warnings by _time

 

 

search 2 - last 30 days

 

 

index=foo source=bar
| bin _time span=1d
| stats dc(accountId) AS Accounts by _time

 

 

 

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try:

index=foo source=bar | eval warning=if(criticality="high" AND state="open",1,0) | bin _time span=1d | stats dc(accountId) AS Accounts sum(warning) as warnings by _time

View solution in original post

DEADBEEF
Path Finder

@somesoni2 you've helped me many times over the years.  Thank you for being a part of this community.  The answer worked like a charm.   I'm going to keep that eval trick in my pocket!

0 Karma

somesoni2
Revered Legend

Give this a try:

index=foo source=bar | eval warning=if(criticality="high" AND state="open",1,0) | bin _time span=1d | stats dc(accountId) AS Accounts sum(warning) as warnings by _time
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...