Dashboards & Visualizations

Overlay two searches with different colors

warok
New Member

I want to create one single graphe, but with two different colors for each searches.
So, create overlay of the two search is easy with OR, but how can I colorize the plots with distinct colors?
Currently, I'm stuck at

vhost=x OR vhost=y

Thanks for the help

0 Karma

to4kawa
SplunkTrust
SplunkTrust

hi, @warok
what's your query?
vhost=x OR vhost=y is not work.

| makeresults
| eval vhost=split("x,y",",")
| stats count by vhost
| eval count=random() % 100
`comment("check this result")`
| transpose 0 header_field=vhost column_name=count

Do you want like above?

0 Karma

warok
New Member

Hi @to4kawa,
(Sorry beginner with splunk), but your command don't give me any output:
makeresults
| eval vhost=split("sso-inactive-dev.sbb.ch,sso-dev.sbb.ch",",")
| stats count by vhost
| eval count=random() % 100
comment("check this result")
| transpose 0 header_field=vhost column_name=count
Can you explain me, what I am doing wrong?
Thanks

0 Karma

to4kawa
SplunkTrust
SplunkTrust
makeresults
⇨
| makeresults
0 Karma

warok
New Member

But if I do
index="wez_fw" vhost=sso-inactive-dev.sbb.ch OR vhost=sso-dev.sbb.ch
| makeresults
| eval vhost=split("sso-inactive-dev.sbb.ch,sso-dev.sbb.ch",",")
| stats count by vhost
| eval count=random() % 100
comment("check this result")
| transpose 0 header_field=vhost column_name=count
I get an error saying that "makeresults" must be first :
alt text

What I'm doing wrong?

0 Karma

to4kawa
SplunkTrust
SplunkTrust
index="wez_fw" vhost="sso-inactive-dev.sbb.ch" OR vhost="sso-dev.sbb.ch"
| stats count by vhost
| transpose 0 header_field=vhost column_name=count

cf. makeresults

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!