Dashboards & Visualizations

Overlay two searches with different colors

warok
New Member

I want to create one single graphe, but with two different colors for each searches.
So, create overlay of the two search is easy with OR, but how can I colorize the plots with distinct colors?
Currently, I'm stuck at

vhost=x OR vhost=y

Thanks for the help

0 Karma

to4kawa
Ultra Champion

hi, @warok
what's your query?
vhost=x OR vhost=y is not work.

| makeresults
| eval vhost=split("x,y",",")
| stats count by vhost
| eval count=random() % 100
`comment("check this result")`
| transpose 0 header_field=vhost column_name=count

Do you want like above?

0 Karma

warok
New Member

Hi @to4kawa,
(Sorry beginner with splunk), but your command don't give me any output:
makeresults
| eval vhost=split("sso-inactive-dev.sbb.ch,sso-dev.sbb.ch",",")
| stats count by vhost
| eval count=random() % 100
comment("check this result")
| transpose 0 header_field=vhost column_name=count
Can you explain me, what I am doing wrong?
Thanks

0 Karma

to4kawa
Ultra Champion
makeresults
⇨
| makeresults
0 Karma

warok
New Member

But if I do
index="wez_fw" vhost=sso-inactive-dev.sbb.ch OR vhost=sso-dev.sbb.ch
| makeresults
| eval vhost=split("sso-inactive-dev.sbb.ch,sso-dev.sbb.ch",",")
| stats count by vhost
| eval count=random() % 100
comment("check this result")
| transpose 0 header_field=vhost column_name=count
I get an error saying that "makeresults" must be first :
alt text

What I'm doing wrong?

0 Karma

to4kawa
Ultra Champion
index="wez_fw" vhost="sso-inactive-dev.sbb.ch" OR vhost="sso-dev.sbb.ch"
| stats count by vhost
| transpose 0 header_field=vhost column_name=count

cf. makeresults

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...