I have two searches that give me two seperate line graphs. I would like to combine these two searches so that they appear on the one graph.
These are the two searches I currently run.
sourcetype=emc-sp sp="SP A" array="Array_xxx" | timechart span=2m avg(utilization)
sourcetype=emc-sp sp="SP B" array="Array_xxx" | timechart span=2m avg(utilization)
Im no sure if this has been answered previously but I couldn't find an answer that would help.
Cheers
Could this be something like it?
sourcetype=emc-sp sp="SP A" OR sp="SP B" array="Array_xxx" | timechart span=2m avg(utilization) by sp
Hope this helps,
Kristian
Could this be something like it?
sourcetype=emc-sp sp="SP A" OR sp="SP B" array="Array_xxx" | timechart span=2m avg(utilization) by sp
Hope this helps,
Kristian
Thanks, its my first day of this and that worked exactly how I needed it too. I had played with the OR but didnt know about the 'by'
Cheers.