Splunk Search
Highlighted

How can I fix my double timechart graphs?

Path Finder

I want to see 2 timecharts that each 1 contains different counter

my search is:
source="perfmon:test" counter="Private Bytes" NOT total instance=chrome | eval MBUsed=Value/1024/1024 | timechart sum(MBUsed) by instance useother=f | append [search counter="Working Set Peak" NOT _total instance=chrome | eval MBUsed=Value/1024/1024 | timechart span=1m avg(MB_Used) useother=f by instance]

With the append command I managed to add the timecharts together but I see them with the same name and the graphs look awkward (the 2 timecharts have the same name so it shows them awkwardly).
Do you have any idea?

0 Karma
Highlighted

Re: How can I fix my double timechart graphs?

Communicator

add this to the end of your 2nd search - "| rename instance AS instance2"

View solution in original post

Highlighted

Re: How can I fix my double timechart graphs?

Path Finder

Thank you!!
If im doing a timechart with "by instance", i will have to rename every instance so it wont have the same name?

0 Karma
Highlighted

Re: How can I fix my double timechart graphs?

Communicator

no, you are only renaming the name of the field, not the values.

0 Karma
Highlighted

Re: How can I fix my double timechart graphs?

Path Finder

Yeah but i see each instance in the first line of each column, which means every instance is a field right?

0 Karma
Highlighted

Re: How can I fix my double timechart graphs?

Communicator

I am sorry, I totally misunderstood. Try this:

source="perfmon:test" counter="Private Bytes" NOT total instance=chrome
| eval MB
Used=Value/1024/1024
| timechart sum(MBUsed) AS mbprivate_bytes by instance useother=f

| appendcols [search counter="Working Set Peak" NOT total instance=chrome
| eval MB
Used=Value/1024/1024
| timechart span=1m avg(MBUsed) AS mbworkingsetpeak useother=f by instance]

0 Karma
Highlighted

Re: How can I fix my double timechart graphs?

Path Finder

Not working, still showing me 1 column named "chrome"

0 Karma
Highlighted

Re: How can I fix my double timechart graphs?

Communicator

hmm, that should give you 2 columns, one called mbprivatebytes and one called mbworkingset_peak with chrome as the instance. Is that not what you are seeing?

What happens if you change the chart format to "multi series mode"?

0 Karma
Highlighted

Re: How can I fix my double timechart graphs?

Communicator

or you can keep it as column, but go to "overlay" and chose one of the values..

0 Karma
Highlighted

Re: How can I fix my double timechart graphs?

SplunkTrust
SplunkTrust

@netanelm7 - How do you want this to look? What is the relationship of the two things you are calculating?

0 Karma