Splunk Search

How can I create a timechart for two different searches

oscargarcia
Path Finder

Hi,

I want to create a timechart that plots results from two separate searches overlapped in the same chart. An example would be timecharting CPU use along Memory use in the same graph.

Any ideas?

Many thanks

0 Karma
1 Solution

LCM
Contributor

If you have the *nix app installed, you can copy/paste this command!

sourcetype=vmstat OR sourcetype=cpu | multikv fields memUsedPct pctIdle | eval CPU_Usage=100-pctIdle | timechart span=10m avg(CPU_Usage) avg(memUsedPct) by host

That gives you a combined timechart (10mins avg.) over CPU & Memory usages per host

View solution in original post

LCM
Contributor

If you have the *nix app installed, you can copy/paste this command!

sourcetype=vmstat OR sourcetype=cpu | multikv fields memUsedPct pctIdle | eval CPU_Usage=100-pctIdle | timechart span=10m avg(CPU_Usage) avg(memUsedPct) by host

That gives you a combined timechart (10mins avg.) over CPU & Memory usages per host

oscargarcia
Path Finder

Thanks! the "multikv fields" was the key one.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...