Splunk Search

Combining two line charts displaying values from the same field name

zd00191
Communicator

I have 2 searches :`

 index=os_windows Host="usatlb9*" object="Network Interface" counter="Bytes Total/sec" |timechart span=30m max(Value) as           "Total Bytes Per Second" by host

 index=os_windows Host="usatlb9*" object="Network Interface" counter="Current Bandwidth" |timechart span=30m max(Value) as "Maximum Network Bandwidth" by host

The field name, 'Value', is the same in both searches. I want to combine both of these line charts into one line chart so that I can see the total bytes per second over the maximum network bandwidth .

Please help! Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

This will do it:

index=os_windows Host="usatlb9*" object="Network Interface" | bucket _time span=30m | stats max(Value) AS Max by _time host counter | timechart span=30m first(Max) AS "Total Bytes Per Second" last(Max) AS "Maximum Network Bandwidth" by host

You might have to swap the names around (the part after AS).
WARNING: There will be problems if you have any period of 30 minutes without at least 1 log for each object+host

View solution in original post

woodcock
Esteemed Legend

This will do it:

index=os_windows Host="usatlb9*" object="Network Interface" | bucket _time span=30m | stats max(Value) AS Max by _time host counter | timechart span=30m first(Max) AS "Total Bytes Per Second" last(Max) AS "Maximum Network Bandwidth" by host

You might have to swap the names around (the part after AS).
WARNING: There will be problems if you have any period of 30 minutes without at least 1 log for each object+host

View solution in original post

Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!