Splunk Search

Creating a line graph that displays two sets of data

jmac131
Engager

I have two searches that give me two seperate line graphs. I would like to combine these two searches so that they appear on the one graph.

These are the two searches I currently run.
sourcetype=emc-sp sp="SP A" array="Array_xxx" | timechart span=2m avg(utilization)
sourcetype=emc-sp sp="SP B" array="Array_xxx" | timechart span=2m avg(utilization)

Im no sure if this has been answered previously but I couldn't find an answer that would help.

Cheers

Tags (2)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

Could this be something like it?

sourcetype=emc-sp sp="SP A" OR sp="SP B" array="Array_xxx" | timechart span=2m avg(utilization) by sp

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Could this be something like it?

sourcetype=emc-sp sp="SP A" OR sp="SP B" array="Array_xxx" | timechart span=2m avg(utilization) by sp

Hope this helps,

Kristian

jmac131
Engager

Thanks, its my first day of this and that worked exactly how I needed it too. I had played with the OR but didnt know about the 'by'
Cheers.

0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...