2 searches 1 graph?

[yumology]

I'm having trouble conceptualizing how to have two or more lines that represent data on a single line chart.

For instance I'd like all these lines overlayed upon each other on a single line chart,
One line will be the exact value of something over the last hour.
"earliest=-1h | timechart span=15s max(myValue)"

Another line will be the lowest value that was reached in the last 24 hours.
"earliest=-24h | timechart span=24h min(myValue)"

While yet a 3rd line will be the average value for the last 7 days.
"earliest=-7d | timechart span=7d avg(myValue)"

And even a 4th line which is the values from yesterday in this same hour...
"earliest=-24h | timechart max(myValue) "???

I can't figure out what single search can do this but I can certainly make this happen with multiple searches so I wonder if I can have one graph display results of all 3 but limiting the time just the last hour?

[Ledion_Bitincka]

Ahh, you should be able to do that using the append command, there are examples in the SplunkDeploymentMonitor app that do this. Let's assume you want to compare today with the same day last week, then the basic idea is as follows:

search .... | timechart span=1h count | eval marker="Today" [search earliest=-7d@h latest=-6d@h ... | timechart span=1h count | eval marker="LastWeek" | eval _time =_time+86400*7] | timechart span=1h sum(count) AS count BY marker

Note: we need to add 86400*7 to the timechart results of last week so that we can overlap the last week's timechart onto the today's.

[Ledion_Bitincka]

You can easily do multiple lines in timecharts, however it seems like you want the timechart buckets to be different for each line, which would mean that you need multiple X-axis - something that is not very common. Anyways, here is how to do multiple series in one chart:

.... | timechart max(field) AS max, min(field) AS min,  avg(field) as avg 

[yumology]

I know about doing it that way. But I'm wondering how to change the time constraint and do a search on that, and display a value from that.

I swear I saw an example somewhere that had a graph of web analytics where it was comparing current number of things bought compared to average number of things bought on this day of the week.