Splunk Search

How do I chart 2 searches on one chart?

afamoyib
Path Finder

Searches

index=nix sourcetype=cpu host="host a"  CPU="all" | eval Percent_CPU_Load = 100 - pctIdle | timechart limit=0 max(Percent_CPU_Load) by host

index=nix source=vmstat sourcetype=vmstat tag=memory host="host a"  | timechart limit=0 max(memUsedPct) by host
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Here is a simpler example of how this might work:
index=* | timechart count by source | append [search index=* | timechart count by sourcetype]

For your search this might work:

index=nix sourcetype=cpu host="host a" CPU="all" | eval Percent_CPU_Load = 100 - pctIdle | timechart limit=0 max(Percent_CPU_Load) by host | append [search index=nix source=vmstat sourcetype=vmstat tag=memory host="host a" | timechart limit=0 max(memUsedPct) by host]
0 Karma

afamoyib
Path Finder

It does not seem to work. It is displaying 3 charts instead of 2

0 Karma

livehybrid
SplunkTrust
SplunkTrust

Are you able to upload a picture so I can see what it looks like?
Thanks

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...