Splunk Search

Can I with one search, graph two different time chart spans?

omarlira
Explorer

I have a simple search only to count the events per timelapse.

I am trying to graph that in only one graph with two time spans: day and hour

I am using for separated

"...| timechart count span=1d"
"...| timechart count span=1h"

Can I join i one sentence a graph that?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this
Update- Fixed typo in the timechart/appendpipe subsearch, updated fieldname

your base search | timechart span=1h count as count_h | appendpipe [ | timechart span=1d sum(count_h) as count_d] | sort 0 _time
0 Karma

omarlira
Explorer

not yet...

0 Karma

omarlira
Explorer

Look that:

"... | timechart span=1h count | appendpipe [ | timechart span=1d sum(count) as count_d] | sort 0 _time"

works fine.

Thanks a lot man!

0 Karma

sundareshr
Legend

The timechart command is missing an alias. Try this

 your base search | timechart span=1h AS count_h | appendpipe [ | timechart span=1d sum(count) as count_d] | sort 0 _time
0 Karma

omarlira
Explorer

Nope

Error in 'timechart' command: The specifier 'count_h' is invalid. It must be in form (). For example: max(size).
The search job has failed due to an error. You may be able view the job in the Job Inspector.

😕

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...