Splunk Search

Combining to source types in one chart

dannux
Path Finder

I am trying to combine 2 different sourcetypes same kind of event (idle CPU) into one chart. Not sure if this is possible. For instance:

sourcetype="estiw_servers-1" and "estiw_servers-2" | timechart span="5m" avg(zCPU_IDLE) by source

What will be the correct syntax?

Many thanks,
Dan

Tags (2)
0 Karma
1 Solution

Ayn
Legend
sourcetype="estiw_servers-1" OR sourcetype="estiw_servers-2" | timechart span="5m" avg(zCPU_IDLE) by source

View solution in original post

Ayn
Legend
sourcetype="estiw_servers-1" OR sourcetype="estiw_servers-2" | timechart span="5m" avg(zCPU_IDLE) by source

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!