Splunk Search

Combining two line charts displaying values from the same field name

zd00191
Communicator

I have 2 searches :`

 index=os_windows Host="usatlb9*" object="Network Interface" counter="Bytes Total/sec" |timechart span=30m max(Value) as           "Total Bytes Per Second" by host

 index=os_windows Host="usatlb9*" object="Network Interface" counter="Current Bandwidth" |timechart span=30m max(Value) as "Maximum Network Bandwidth" by host

The field name, 'Value', is the same in both searches. I want to combine both of these line charts into one line chart so that I can see the total bytes per second over the maximum network bandwidth .

Please help! Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

This will do it:

index=os_windows Host="usatlb9*" object="Network Interface" | bucket _time span=30m | stats max(Value) AS Max by _time host counter | timechart span=30m first(Max) AS "Total Bytes Per Second" last(Max) AS "Maximum Network Bandwidth" by host

You might have to swap the names around (the part after AS).
WARNING: There will be problems if you have any period of 30 minutes without at least 1 log for each object+host

View solution in original post

woodcock
Esteemed Legend

This will do it:

index=os_windows Host="usatlb9*" object="Network Interface" | bucket _time span=30m | stats max(Value) AS Max by _time host counter | timechart span=30m first(Max) AS "Total Bytes Per Second" last(Max) AS "Maximum Network Bandwidth" by host

You might have to swap the names around (the part after AS).
WARNING: There will be problems if you have any period of 30 minutes without at least 1 log for each object+host

Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...